use a less-generic csrf cookie name

for easier debugging, and because otherwise it conflicts with the one
used by our graphite webapp, which is annoying.