Keep uid unique across single request

[bluepnume]

Problem:

a) User calls to generate header token with UID X b) Header token gets dropped on request end with UID Y c) Cookie gets dropped with UID Y

The UID doesn't match between a) and c) so CSRF breaks. Need to persist the UID in req to make sure this doesn't happen.