title: CSRF tokens - how to implement properly?
body: <p>I've just setup a simple CSRF protection in my application. It creates a unique crumb which are validated against a session value upon submitting a form.</p>
  
  <p>Unfortunately this means now that I can't keep multiple instances (tabs in the browser) of my application open simultaneously as the CSRF crumbs collide with each other.</p>
  
  <p>Should I create an individual token for each actual form or use a mutual, shared crumb for all my forms?
  What are common sense here?  </p>