title: Flask-wtf: csrf_token is removed from session before I can POST my form
body: <p>I'm using Flask with Flask-Security (specifically Flask-WTF regarding my csrf issue) to "ease" the process of register/loggin users (not easy so far). I'm using BackboneJS on the front-end, therefore I kind of hacked the original way to use Flask-WTF. Indeed, I make an AJAX GET request on /register to get the register page (generated by Flask-Security) and I put the resulting HTML in a modal.</p>
  
  <pre><code>render: function () {
              var self = this;
              $.ajax({
                  type: 'GET',
                  url: Config.constants.serverGateway + "/register"
              }).done(function(result){
                  console.log("get register done", result);
                  var html = self.template({ config: Config, form: result });
                  self.$el.html(html);
              }).fail(function(error){
                  console.log("Could not get register token", error);
                  var html = this.errorTemplate({ config: Config });
                  self.$el.html(html);
              });
  
              return this;
          }
  </code></pre>
  
  <p>This way I have the generated csrf, and when I POST the registration data, I send the right csrf along the user data (email and password).</p>
  
  <pre><code>submit: function () {
              console.log("submit");
              var self = this;
              var formData = this.$el.find('form').serialize();
              $.ajax({
                  type: 'POST',
                  url: Config.constants.serverGateway + "/register",
                  data: formData,
                  dataType: 'json'
              }).done(function(result){
                  self.trigger('close');
              }).fail(function(error){
                  console.log("Could not submit register data", error);
              });
          }
  </code></pre>
  
  <p>On the server-side, I can debug my python code to see that the csrf_token which has been generated when I requested the register page has disappeared from the session object, therefore leading to the generation of a new one, which of course didn't match the one I send with my form. The session is still the same though, as the _id is the same during the GET and the POST.</p>
  
  <p>You can see the code in flask_wtf/csrf.py::generate_csrf(), which is called when creating the form object in the ::register function from flask_security/views.py</p>
  
  <pre><code>if 'csrf_token' not in session:
      session['csrf_token'] = hashlib.sha1(os.urandom(64)).hexdigest()
  </code></pre>
  
  <p>It results in a CSRF TOKEN MISSING error.</p>
  
  <p>An additionnal information, is that my front-end and back-end are delivered by the same server, as they have a different port number.</p>
  
  <p>Last, when I use an href on front-end and display the page returned by the server on the 'GET' request, submitting the form works well. I just liked to display this registration form in a modal.</p>
  
  <p>Thanks for your help</p>