Use return {} idiom for csrf

Not sure why we reverted this in 24b8cf5. The tests still pass
without setting state early.

gratipay/security/csrf.py

@@ -61,7 +61,7 @@ def _sanitize_token(token):
 
 
 
-def get_csrf_token_from_request(request, state):
+def get_csrf_token_from_request(request):
     """Given a Request object, reject it if it's a forgery.
     """
     if request.line.uri.startswith('/assets/'): return
@@ -72,7 +72,7 @@ def get_csrf_token_from_request(request, state):
     except KeyError:
         cookie_token = None
 
-    state['csrf_token'] = cookie_token or _get_new_csrf_key()
+    cookie_token or _get_new_csrf_key()
 
     # Assume that anything not defined as 'safe' by RC2616 needs protection
     if request.line.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE'):
@@ -94,6 +94,8 @@ def get_csrf_token_from_request(request, state):
         if not constant_time_compare(second_token, cookie_token):
             raise Response(403, REASON_BAD_TOKEN)
 
+        return {'csrf_token': second_token}
+
 
 def add_csrf_token_to_response(response, csrf_token=None):
     """Store the latest CSRF token as a cookie.