pub fn verify(cx: &Cx, values: &HashMap<String, String>) -> Result<(), Error>
Verifies the submitted token matches the cookie with a constant-time compare, failing closed with 403.