Add CSRF hidden field helper

site/doc/pages/csrf_field.txt

@@ -0,0 +1,27 @@
+:sig
+String csrf_field(String session_name = "uce-session", String token_name = "csrf_token", String field_name = "")
+
+:params
+session_name : session/cookie name to store the token under
+token_name : form/action token namespace
+field_name : submitted POST field name; defaults to `token_name`
+return value : HTML hidden input containing the active CSRF token
+
+:content
+Starts the named session if needed and returns the standard hidden form input for a CSRF token. The field name and generated token value are HTML-escaped.
+
+Use this in ordinary server-rendered POST forms when the submitted field name should match `token_name`, or pass `field_name` when several forms share the same submitted parameter name but need separate token namespaces. Validate the submitted value with `csrf_valid(context.post[field_name], session_name, token_name)` before mutating state.
+
+:example
+?><form method="post">
+	<?= csrf_field("uce-doc-session") ?>
+	<?= csrf_field("uce-doc-session", "profile_form", "csrf_token") ?>
+	<button type="submit">Save</button>
+</form><?
+
+:see
+>http
+csrf_token
+csrf_valid
+csrf_rotate
+session_start

site/doc/pages/csrf_token.txt

@@ -21,6 +21,7 @@ String token = csrf_token("uce-doc-session");
 :see
 >http
 csrf_valid
+csrf_field
 csrf_rotate
 session_start
 random_bytes