Unneccessary session loading/creation in form_authenticity_token

This is the current implementation of form_authenticity_token:

def form_authenticity_token
  session[:_csrf_token] ||= ActiveSupport::SecureRandom.base64(32)
end

The problem with it:

When user doesn't have a session and visits page with form protected from request forgery Rails automatically create new session for him just to store csrf_token. When user has a session cookie and visits page with form, Rails loads the session just to retrieve csrf_token, even if the session is not used entirely in the given action.

In applications with main functionality accessible after login the session can be used only in actions for logged, trusted users. This design protect against DoS against session store (when something else than cookie store is being used) as not logged attackers won't be able to create and even load the session.

My idea is to introduce two changes to make form_authenticity_token not create or load the session:

1. Create method to get session id without loading the session itself. Except cookie store it is as easy as getting session id from cookie. In cookie store it should be acceptable to load the session to get id as it doesn't cost much.
2. Modify form_authenticity_token to return HMAC(session_id, server_side_secret). Yup, code changed by this nice commit needs to be changed once again. HMAC is to make it impossible for attacker to obtain session id from forgery protection token (as it is easier for him to obtain token than session). Secret is safely stored on server so session id will be secure.

Note: when session cookie is not set in the browser, getting session id would require setting this cookie. This is side effect, but it is already present in Rails -- loading the session (to get session id) automatically sets the cookie.