title: is a hashed uuid4 a good csrf token?
body: <p>Is this a good csrf token? Does it have enough entropy, or are there parts that are easily guessable and could reduce the entropy, like the time of the request?</p>
  
  <p>An example python implementation would b</p>
  
  <pre><code>token = hashlib.sha256(str(uuid.uuid4())).hexdigest()
  </code></pre>