:sig
function csrf_field(session_name : string = "bearer-session", token_name : string = "csrf_token", field_name : string = "", request : capture dval) string

:params
request : the caller's request, captured when omitted
session_name : the session and cookie name
token_name : the token namespace
field_name : the form field name. The default is `token_name`.

:returns
An HTML hidden input with the active CSRF token.

:content
`csrf_field()` returns a hidden form input with the active CSRF token.

Use it in a form that changes state. Check the submitted value with `csrf_valid()` before you change state.

:example capy render
var field := csrf_field("capy-doc-session", "profile", "csrf_token")
print(contains(field, "type=\"hidden\""), "\n")

:see-group
csrf
