No need to persist() the session when generating CSRF.
No need to persist() the session when generating CSRF.

The session will be persisted at the end of the request, right before
the CSRF is actually returned to the browser.

SUNET/eduid-common