CSRF protection via session double-submit (Laravel-style).
Install after sessions. Mutating requests are checked for a matching token in
(order): X-CSRF-TOKEN → X-XSRF-TOKEN → query field →
application/x-www-form-urlencoded body field.
Multipart bodies are left to handlers ([CsrfExt::verify_csrf]) unless the
header/query carries the token.
With [Csrf::xsrf_cookie] (default on), each response also gets a readable
XSRF-TOKEN cookie so SPA clients (axios) can send X-XSRF-TOKEN.