pub const CSRF_HEADER: &str = "x-csrf-token";
The header carrying the per-session CSRF token on unsafe methods.