code: function setSecret (req, res, sessionKey, val, cookie) {
    if (cookie) {
      // set secret on cookie
      var value = val
  
      if (cookie.signed) {
        value = 's:' + sign(val, req.secret)
      }
  
      setCookie(res, cookie.key, value, cookie)
    } else {
      // set secret on session
      req[sessionKey].csrfSecret = val
    }
  }
docs: Set the token secret on the request.
  
  @param {IncomingMessage} req
  @param {OutgoingMessage} res
  @param {string} sessionKey
  @param {string} val
  @param {Object} [cookie]
  @api private