pub const CSRF_HEADER: &str = "x-didbot-csrf";
The header a mutating operator request must echo its session’s CSRF token in. A cookie rides along on a cross-origin form post; this does not.