code: func csrfMiddleware(unique string, prefix string, cfg config.GUIConfiguration, next http.Handler) http.Handler {
  	loadCsrfTokens()
  	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  		// Allow requests carrying a valid API key
  		if cfg.IsValidAPIKey(r.Header.Get("X-API-Key")) {
  			// Set the access-control-allow-origin header for CORS requests
  			// since a valid API key has been provided
  			w.Header().Add("Access-Control-Allow-Origin", "*")
  			next.ServeHTTP(w, r)
  			return
  		}
  
  		if strings.HasPrefix(r.URL.Path, "/rest/debug") {
  			// Debugging functions are only available when explicitly
  			// enabled, and can be accessed without a CSRF token
  			next.ServeHTTP(w, r)
  			return
  		}
  
  		// Allow requests for anything not under the protected path prefix,
  		// and set a CSRF cookie if there isn't already a valid one.
  		if !strings.HasPrefix(r.URL.Path, prefix) {
  			cookie, err := r.Cookie("CSRF-Token-" + unique)
  			if err != nil || !validCsrfToken(cookie.Value) {
  				l.Debugln("new CSRF cookie in response to request for", r.URL)
  				cookie = &http.Cookie{
  					Name:  "CSRF-Token-" + unique,
  					Value: newCsrfToken(),
  				}
  				http.SetCookie(w, cookie)
  			}
  			next.ServeHTTP(w, r)
  			return
  		}
  
  		// Verify the CSRF token
  		token := r.Header.Get("X-CSRF-Token-" + unique)
  		if !validCsrfToken(token) {
  			http.Error(w, "CSRF Error", 403)
  			return
  		}
  
  		next.ServeHTTP(w, r)
  	})
  }
docs: // Check for CSRF token on /rest/ URLs. If a correct one is not given, reject
  // the request with 403. For / and /index.html, set a new CSRF cookie if none
  // is currently set.