Token to embed in a form, plus a Set-Cookie value when a new one was
minted. An existing cookie is reused rather than replaced, so opening the
same form in two tabs doesn’t invalidate the first one’s token.
True when the submitted field matches the cookie. Both must be present and
non-empty, so a request that carries neither is rejected rather than passed.