improve the anti-csrf token

[CoolerVoid]

So token with timeout is not necessary, because repeat any times... this loss security... Change timeout options to use session, each time put diferent token and uses HMAC() function in sha256().