improve: use the expiration timestamp in csrf plugin

[Baoyuantop]

Just a proposal here, in the token object instead of total expiration seconds, can we use the expiration timestamp? So during the checking phase inside the check_csrf_token method, we could potentially check/prevent/[minimize the window] of replay attacks as an added benefit by figuring out if the generated cookie is long been expired or not. WDYT
Thank you. cc @spacewander

Originally posted by @bisakhmondal in #5727 (comment)