Allow resetting the XSRF cookie/token

OWASP recommends to generate a new CSRF token after authentication:

Remember that pre-sessions cannot be transitioned to real sessions once the user is authenticated - the session should be destroyed and a new one should be made to avoid session fixation attacks.

Calling self.clear_cookie('_xsrf') followed by self.xsrf_token doesn't reset the cookie, for obvious reasons.

So, when the user logs in, currently, I'm doing this:

del self.cookies['_xsrf'] # delete cookie

if hasattr(self, '_xsrf_token'):
    delattr(self, '_xsrf_token') # remove cached token

if hasattr(self, '_raw_xsrf_token'):
    delattr(self, '_raw_xsrf_token') # remove cached token

self.xsrf_token # generate new token

But I fear this may break in future as this isn't official API. It would be better if the RequestHandler provided an official way to do it; something like self.reset_xsrf_token() maybe.

Start with RequestHandler's xsrf_token handling and the cookie and cached-token state described in the issue. Trace how the current token is generated and identify the existing XSRF tests or entry points before changing the public API. Done means an official reset operation removes the old token state and makes a new token available after authentication.