[FIX] Use session ID for user uniqueness
Merge pull request #1754 from MPOS/csrf-validation

[FIX] Use session ID for user uniqueness