httpauth.py, cookies.fhtml: Randomize CSRF token to prevent BREACH.