Returns the hidden input a form carries for a session's CSRF token.
the session id
the HTML input, or an empty string when there is no session
Returns the hidden input a form carries for a session's CSRF token.