Records the session CSRF token a render carried, so a shared plan can substitute it.
The token is the one slot value the front worker cannot generate. Like the role set it is learned
from the object's own render for this cookie, never the request. Someone else's token would be
inert (Drupal refuses it) but break the logout link, so the value is per session.
Records the session CSRF token a render carried, so a shared plan can substitute it.
The token is the one slot value the front worker cannot generate. Like the role set it is learned from the object's own render for this cookie, never the request. Someone else's token would be inert (Drupal refuses it) but break the logout link, so the value is per session.