Reuse session csrf token

[davidgonmar]

Reuse token from existing session cookie.
This enables multitab support by not overwriting existing csrf cookies.
Functionality can be toggled with the param 'overwrite', which defaults to true (reusability of tokens is disabled by default).

[psibean]

So I've just had some additional thoughts:

• Now that the plain token is also included in the cookie value, we should set the signed cookie option to true - similar to the httpOnly flag, this should be forced and passed as true directly in the inner call, so we should omit the signed option from the prop type.
• We can then delete the signed/unsigned test case, only the default one of those matters as signed is always true.
• Documentation will need to explicitly state that a different secret must be provided to cookie parser - we should update the existing examples to reflect this usage.

[psibean]

I've pulled down your branch and made some changes on the branch: https://github.com/Psifi-Solutions/csrf-csrf/tree/reuse-session-csrf-token

You may be able to cherry-pick the commit: b24f941

My plan is for this to be a major update given the changes, thus I am also setting the default of overwrite to false - this way it mimics the csrf-sync behaviour.

Additionally, in another PR after this one, I'll make another breaking change which will finally switch the order of response and request params for generateToken 😂