Function sessionCsrf

The session CSRF token in one render, or undefined.

Read from the render, not the request: a client cannot present a token, it is told its own.