pub const CSRF_HEADER_NAME: &str = "x-krabka-csrf";Expand description
The header a JSON mutation carries its CSRF token in.
A browser cannot set this header on a cross-origin request without a preflight that this server never answers, and a page on another origin cannot read the token, so only the UI itself can send it.