:sig
function csrf_token(session_name : string = "bearer-session", token_name : string = "csrf_token", request : capture dval) string

:params
request : the caller's request, captured when omitted
session_name : the session and cookie name
token_name : the token namespace in the session

:returns
The active CSRF token.

:content
`csrf_token()` returns a stable token for one session and token namespace.

Use the result in a hidden form field. Call `csrf_valid()` before you apply a browser-submitted change.

:example capy render
var token := csrf_token("capy-doc-session")
print(length(token) > 0, "\n")

:see-group
csrf
