docs: function securityAssert(ctx) {
        // all disabled. don't need check
        if (!csrfEnable && !validateReferrer) return;
  
        // pass referrer check
        const referrer = ctx.get('referrer');
        if (validateReferrer && validateReferrer(referrer)) return;
        if (csrfEnable && validateCsrf(ctx)) return;
  
        const err = new Error('jsonp request security validate failed');
        err.referrer = referrer;
        err.status = 403;
        throw err;
      }