Security bugfix: Generate default token

The registration page now generates a token cookie upon load; as an
empty token cookie means the site is still vulnerable to CSRF