code: func isValidCSRF(w http.ResponseWriter, r *http.Request) bool {
  	// TODO look into other session-based temporary storage systems for
  	// these csrf tokens to prevent hitting the database.  Whatever is
  	// selected must *not* introduce an external (system) dependency like
  	// memcached/Redis. Bolt might be an option.
  	log.Debug("validating csrf")
  	var label string
  	q := `SELECT label FROM sessions
  	      WHERE userid=$1 AND label='csrfToken' AND token=$2`
  	cookie, err := r.Cookie("id")
  	if err == http.ErrNoCookie {
  		writeErrorAuth(w, err)
  		return false
  	}
  	if err != nil {
  		writeErrorInternal(w, err)
  		return false
  	}
  	uid := cookie.Value
  	cookie, err = r.Cookie("csrfToken")
  	if err == http.ErrNoCookie {
  		writeErrorAuth(w, err)
  		return false
  	}
  	if err != nil {
  		writeErrorInternal(w, err)
  		return false
  	}
  	err = db.Get(&label, q, uid, cookie.Value)
  	if err == sql.ErrNoRows {
  		writeErrorAuth(w, errors.New("invalid CSRF token"))
  		return false
  	}
  	if err != nil {
  		writeErrorInternal(w, err)
  		return false
  	}
  	log.Debug("validated csrf")
  	return true
  }
docs: // isValidCSRF ensures that any forms posted to Abot are protected against
  // Cross-Site Request Forgery. Without this function, Abot would be vulnerable
  // to the attack because tokens are stored client-side in cookies.