:sig
function csrf_valid(submitted : string, session_name : string = "bearer-session", token_name : string = "csrf_token", request : capture dval) bool

:params
request : the caller's request, captured when omitted
submitted : the value from the submitted form
session_name : the session and cookie name
token_name : the token namespace

:returns
`true` if `submitted` matches the active session token.

:content
`csrf_valid()` checks a submitted CSRF token against the session token.

It does not create a missing token. Check the token before you apply a browser-submitted change.

:example capy render
var token := csrf_token("capy-doc-session")
print(csrf_valid(token, "capy-doc-session"), "\n")

:see-group
csrf

:see
crypto_equal
