Start a session with all the security flags you should always set: HttpOnly, SameSite=Strict, Secure on HTTPS, custom name, and an idle-timeout regeneration.
Per-session CSRF token helpers using hash_equals for constant-time comparison. Token is regenerated on logout but persists across requests within a session.