title: Is this csrf failure expected?
body: <p>Given the following series of events</p>
  
  <ol>
  <li>anonymous user opens home page, which contains a form (with a valid csrf token)</li>
  <li>the user opens a secondary tab and logs in.</li>
  <li>the user returns to the original tab and submits the form.</li>
  </ol>
  
  <p>Is the resulting csrf failure expected, and if so, are there any solutions that will give the user a better experience?</p>