code: function includeCSRFToken ({ method, csrf=true, headers }) {
    if (!csrf || !CSRF_METHODS.includes(method)) return
    const token = getTokenFromDocument(csrf)
    if (!token) return
    return {
      headers: { ...headers, 'X-CSRF-Token': token }
    }
  }
docs: Adds a CSRF token in a header if a 'csrf' option is provided