pub fn mint_csrf_token() -> String
Mints a CSRF token. Same entropy as a session token — it is stored in plaintext, but it still has to be unguessable.