Derives the CSRF token for a session: HMAC-SHA256 of the session id under the cluster's shared CSRF key.
the session id
the base64url token, or an empty string when there is no session
Derives the CSRF token for a session: HMAC-SHA256 of the session id under the cluster's shared CSRF key.