Decouple session from csrf handler, set initial lastActivity

includes/csrf.php

@@ -1,7 +1,6 @@
 <?php
 
 require_once 'functions.php';
-require_once 'session.php';
 
 if (csrfValidateRequest() && !CSRFValidate()) {
     handleInvalidCSRFToken();

includes/session.php

@@ -3,3 +3,8 @@
 if (session_status() == PHP_SESSION_NONE) {
     session_start();
 }
+
+if (!isset($_SESSION['lastActivity'])) {
+    $_SESSION['lastActivity'] = time();
+}
+

index.php

@@ -23,6 +23,7 @@
  * as you leave these references intact in the header comments of your source files.
  */
 
+require 'includes/session.php';
 require 'includes/csrf.php';
 ensureCSRFSessionToken();