Separate tokens/tracking should be used for csrf and Spotify state

[kclapper]

Right now, the state included with requests to Spotify is also the csrf token used for the form. It should likely be updated such that these are two separate token/tracking systems.