Shorter than `CSRF_KEY_LENGTH` ✕ 2, actually. I'll go and fix that now.