Retrieve a csrf token (the default).