scjody/django-session-csrf — comment on commit 4b92d9d2c6fd6faeb3c35b3b7766272b4cffa4e9
File:  line 0
By jbalogh:

Oh yeah, if the attacker changed the csrf token your session id would still be pointing at your account so it wouldn't matter. I was wrong about that one. Exposing the token is still giving me an uneasy feeling; I'll try to figure out why.