Experimental: add `csrf-token-fn` option
Misc hk
Experimental: client auto-detection of csrf-token + own uid
TODOs