title: Does django csrf token must be unique on every request?
body: <p>I have a question about Django CsrfViewMiddleware mechanism. 
  I know, that Django:</p>
  
  <ol>
  <li>Set new csrftoken cookie on every request.</li>
  <li>Check, than X-CSRFToken header value (or hidden input "csrfmiddlewaretoken") must be equals to csrftoken cookie.</li>
  </ol>
  
  <p>But Django doesn't check whether token has been used already (example from CsrfViewMiddleware):</p>
  
  <pre><code>if not constant_time_compare(request_csrf_token, csrf_token):
              return self._reject(request, REASON_BAD_TOKEN)
  </code></pre>
  
  <p>So I can POST multiple requests with the same token (I tested it on my server). </p>
  
  <p>Is it standart behavior, or I have incorrect Django setup?
  Thanks.</p>