When we generate account tokens for CSRF keys and email verification, one of the inputs we use is the user's password hash. Users won't always have a password hash, so this is a weak input to key generation. This also couples CSRF weirdly with auth concerns.

Instead, give users a dedicated secret for use in token generation which is used only for this purpose.

• Ran upgrade scripts.
• Verified all users got new secrets.
• Created a new user.
• Verified they got a secret.
• Submitted CSRF'd forms, they worked.
• Adjusted the CSRF token and submitted CSRF'd forms, verified they don't work.