Remove XSRF options, make token as long as the session. RE #2118