pub const HEADER_NAME: &str = "X-CSRF-TOKEN";Expand description
The header a JS-driven request (fetch/XMLHttpRequest) can send the
token in instead of a form field - matches Laravel’s own X-CSRF-TOKEN
convention, typically sourced from a <meta name="csrf-token"> tag.
HeaderMap::get is case-insensitive, so the exact casing here doesn’t
matter for matching, only for what a client sees if it inspects the name.