docs: function csrfCheck(req, res, next) {
  
      //Only check for non-GET requests, since GETs don't modify state
      if ('GET' !== req.method && 'HEAD' !== req.method) {
  
          if (req.get('Origin')) {
  
              for (var i = 0; i < whitelist.length; i++) {
                  //whitelist can also contain regexps
                  if (whitelist[i] instanceof RegExp && whitelist[i].test(req.headers.origin)) {
                      return next();
                  } else if (whitelist[i] === req.headers.origin) {
                      return next();
                  }
              }
  
              _logger.warn('CSRF request failed for origin, %s', req.headers.origin);
              return res.sendStatus(400);
          } else {
              return next();
          }
      } else {
          return next(); //no need to check origin
      }
  
  }