[1.6.x] Prevented leaking the CSRF token through caching.

      This is a security fix. Disclosure will follow shortly.

Backport of c083e3815aec23b99833da710eea574e6f2e8566 from master