code: function getSecret (req, sessionKey, cookie) {
    // get the bag & key
    var bag = getSecretBag(req, sessionKey, cookie)
    var key = cookie ? cookie.key : 'csrfSecret'
  
    if (!bag) {
      throw new Error('misconfigured csrf')
    }
  
    // return secret from bag
    return bag[key]
  }
docs: Get the token secret from the request.
  
  @param {IncomingMessage} req
  @param {String} sessionKey
  @param {Object} [cookie]
  @api private