Generate new CRSF token once per session instead of per request

Generate new CRSF token once per session instead of per request

It is tempting to generate the token once per request and have
multiple windows in the browser share the token via javascript's
session local storage.  But there are a number of race conditions,
including not being able to submit a new request in the interval
between the server sending a response and the browser receiving
the response.  Per-request CSRF tokens are just too much bother
for what you get.