code: @Override
  	protected boolean isAllowed(HttpServletRequest request) {
  		HttpSession session = getRequest().getSession(false);
  		
  		if (session == null)
  			return false;
  		
  		String sessionToken = (String) session.getAttribute(SESSION_ATTR_CSRF_TOKEN);
  		String requestToken = request.getHeader(CSRF_HEADER);
  			
  		return Objects.equals(sessionToken, requestToken);
  	}
docs: INSTANCE SCOPE ==========================================================