'Generates and returns a CSRF token for the current session
:param time_limit: the CSRF token should only be valid for the
specified duration (in second), by default 1h,
``None`` for the token to be valid as long as the
current user\'s session is.
:type time_limit: int | None
:returns: ASCII token string'

def csrf_token(self, time_limit=3600):

    token = self.session.sid
    max_ts = ('' if (not time_limit) else int((time.time() + time_limit)))
    msg = ('%s%s' % (token, max_ts))
    secret = self.env['ir.config_parameter'].sudo().get_param('database.secret')
    assert secret, 'CSRF    protection    requires    a    configured    database    secret'
    hm = hmac.new(str(secret), msg, hashlib.sha1).hexdigest()
    return ('%so%s' % (hm, max_ts))
