csrf
you think we should bake it in? i think it's easier and not too complicated to bake it in since in this case, the "secret" can be retrieved synchronously and lazily, but in db stores, the "secret" has to be retrieved asynchronously and/or the session already has to be retrieved. 
