Is session ID enough for a CSRF token? - I got a printer