Right now, Flask is merely holding the CSRF tokens that WTForms generates in memory. We need these in a shared storage, otherwise things will only work when you fluke out and POST/PUT/DELETE to the same server you got the token from. We can probably use redis or memcached for this. Worst case scenario, another table in the db will do it.

I was digging around last night and I'm 99% sure we don't need this. WTForms' CSRF validation calculates an HMAC digest based on a secret key. For us, that secret key is set in admin.ini and consistent across webheads. https://bitbucket.org/simplecodes/wtforms/src/64016474112e/wtforms/ext/csrf/session.py#cl-54