We currently rotate CSRF tokens and sessions independently. This is not a security issue, but it causes a lot of false positive reports on HackerOne where researchers misunderstand the mechanism, think CSRF tokens can be transferred between accounts, etc.

Since we rotate sessions and CSRF tokens, binding them directly to one another isn't desirable, because it will make rotation entangled and complicated.

However, we can introduce a non-rotating "session core" secret which we hash into CSRF tokens. This won't appreciably improve security, but will make the system look more secure.