Trying to track down decay of user session (disappearing CSRF token)