public function generateCSRFToken(CSRFTokenField $csrf_token_field)
    {
        $meta = $this->form_meta;
        if (!$meta->csrf_secret) {
            throw new \Exception("Must set `csrf_secret` on class Meta for SessionCSRF to work");
        }
        if (session_status() !== PHP_SESSION_ACTIVE) {
            throw new TypeError("Must must have an active session to use SessionCSRF");
        }

        if (!array_key_exists($this->session_key, $_SESSION)) {
            $_SESSION[$this->session_key] = sha1(openssl_random_pseudo_bytes(64));
        }

        if ($this->time_limit) {
            $expires = $this->now()->addSeconds($this->time_limit)->format(str_replace('%', '', self::TIME_FORMAT));
            $this->now()->subSeconds($this->time_limit);
            $csrf_build = sprintf("%s%s", $_SESSION[$this->session_key], $expires);
        } else {
            $expires = '';
            $csrf_build = $_SESSION[$this->session_key];
        }
        $hmac_csrf = hash_hmac('sha1', $csrf_build, $meta->csrf_secret);

        return "$expires##$hmac_csrf";
    }