code: func createCSRFToken(u *dt.User) (token string, err error) {
  	q := `INSERT INTO sessions (token, userid, label)
  	      VALUES ($1, $2, 'csrfToken')
  	      ON CONFLICT (userid, label) DO UPDATE SET token=$1`
  	token = RandSeq(32)
  	if _, err := db.Exec(q, token, u.ID); err != nil {
  		return "", err
  	}
  	return token, nil
  }
docs: // createCSRFToken creates a new token, invalidating any existing token.