This is offical crate, so you can enable it in Cargo.toml like this:
Cargo.toml
salvo = { version = "*", features=["csrf"] }