function checkToken(token, secret) {
  if ('string' != typeof token) return false;
  return token === createToken(token.slice(0, 10), secret);
}
Checks if a given CSRF token matches the given secret.

@param {String} token
@param {String} secret
@return {Boolean}
@api private