code: function defaultValue (req) {
    return (req.body && req.body._csrf) ||
      (req.query && req.query._csrf) ||
      (req.headers['csrf-token']) ||
      (req.headers['xsrf-token']) ||
      (req.headers['x-csrf-token']) ||
      (req.headers['x-xsrf-token'])
  }
docs: Default value function, checking the `req.body`
  and `req.query` for the CSRF token.
  
  @param {IncomingMessage} req
  @return {String}
  @api private