function createToken(secret) {
      var token;

      // lazy-load token
      req.csrfToken = function csrfToken() {
        return token || (token = saltedToken(secret));
      };
      
      // compatibility with old middleware
      Object.defineProperty(req.session, '_csrf', {
        configurable: true,
        get: function() {
          console.warn('req.session._csrf is deprecated, use req.csrfToken() instead');
          return req.csrfToken();
        }
      });
      
      // ignore these methods
      if ('GET' == req.method || 'HEAD' == req.method || 'OPTIONS' == req.method) return next();
      
      // determine user-submitted value
      var val = value(req);
      
      // check
      if (!checkToken(val, secret)) return next(utils.error(403));
      
      next();
    }
Anti CSRF:

CSRF protection middleware.

This middleware adds a `req.csrfToken()` function to make a token
which should be added to requests which mutate
state, within a hidden form field, query-string etc. This
token is validated against the visitor's session.

The default `value` function checks `req.body` generated
by the `bodyParser()` middleware, `req.query` generated
by `query()`, and the "X-CSRF-Token" header field.

This middleware requires session support, thus should be added
somewhere _below_ `session()` and `cookieParser()`.

Options:

   - `value` a function accepting the request, returning the token

@param {Object} options
@api public