title: CSRF protection: do we have to generate a token for every form?
body: <p>Do we have to generate a token, for every form in a website? I mean, every-time to generate different token for every requested form? If not, why?</p>