:sig
function csrf_rotate(session_name : string = "bearer-session", token_name : string = "csrf_token", request : capture dval)

:params
request : the caller's request, captured when omitted
session_name : the session and cookie name
token_name : the token namespace to clear

:content
`csrf_rotate()` removes the active CSRF token from a token namespace.

The next `csrf_token()` call creates a replacement token. Use it after a sensitive successful change.

:example capy render
var old_token := csrf_token("capy-doc-session")
csrf_rotate("capy-doc-session")
var new_token := csrf_token("capy-doc-session")
print(old_token != new_token, "\n")

:see-group
csrf
