feature: configure csrf token sharing

closes #389

Author: Greg Bowler

config.default.ini

@@ -54,3 +54,5 @@ csrf_header=X-CSRF
 csrf_ignore_path=
 csrf_max_tokens=100
 csrf_token_length=10
+;Generate tokens once "per-form" or once "per-page"
+csrf_token_sharing=per-page

src/Middleware/RequestHandler.php

@@ -233,8 +233,12 @@ public function handle(
 					$csrfTokenStore->verify($_POST);
 				}
 
+				$sharing = match($this->config->getString("security.csrf_token_sharing")) {
+					"per-page" => HTMLDocumentProtector::ONE_TOKEN_PER_PAGE,
+					default => HTMLDocumentProtector::ONE_TOKEN_PER_FORM,
+				};
 				$protector = new HTMLDocumentProtector($viewModel, $csrfTokenStore);
-				$tokens = $protector->protect(HTMLDocumentProtector::ONE_TOKEN_PER_FORM);
+				$tokens = $protector->protect($sharing);
 				$response = $response->withHeader($this->config->getString("security.csrf_header"), $tokens);
 			}
 		}