Change anti-CSRF security token lifetime to be session-based