title: New CSRF token per request or NOT?
body: <p>So I am reading around and was really confused about having a CSRF token, whetever I should generate a new token per each request, or just per hour or something? </p>
  
  <pre><code>$data['token'] = md5(uniqid(rand(), true));
  $_SESSION['token'] = $data['token'];
  </code></pre>
  
  <p>But let's say it's better to generate a token each hour, then I would need two sessions: token, expiration,</p>
  
  <p>And how will I proceed it to the form? Just put echo $_SESSION['token'] on the hidden value form and then compare on submit?</p>