=== CsrfHandler

The javadoc:CsrfHandler[text="Cross Site Request Forgery Handler"] helps to protect from (CSRF) 
attacks. Cross-site request forgeries are a type of malicious exploit whereby unauthorized commands
are performed on behalf of an authenticated user.

Jooby automatically generates a CSRF "token" for each active user session managed by the 
application. This token is used to verify that the authenticated user is the one actually making 
the requests to the application.

Anytime you define an HTML form in your application, you should include a hidden CSRF token 
field in the form so that the CSRF protection middleware can validate the request

.CSRF
[source, html]
----
<form method="POST" action="...">
    <input name="csrf" value="{{csrf}}" type="hidden" />
    ...
</form>
----

The `csrf` is a request attribute created by the javadoc:CsrfHandler[] handler and rendered by a
template engine. Here `{{csrf}}` we use Handlebars template engine (as example).

The javadoc:CsrfHandler[] handler, will automatically verify that the token in the request input 
matches the token stored in the session.

The token defaults name is `csrf` and can be provided as:

- header
- cookie
- form parameter

Configuration methods:

- javadoc:CsrfHandler["setTokenGenerator", java.util.Function]: Set a custom token generator. Defaults uses a random UUID.
- javadoc:CsrfHandler["setRequestFilter", java.util.Predicate]: Set a custom request filter. Defaults is to process `POST`, `PUT`, `PATCH` and `DELETE`.
