https://stevenroland.com/posts/simple-php-csrf-token