code: func save(encodedToken string, w http.ResponseWriter) string {
  	cookie := &http.Cookie{
  		Name:     CookieName,
  		Value:    encodedToken,
  		MaxAge:   defaultMaxAge,
  		HttpOnly: true,
  		Secure:   true,
  		Path:     "/",
  	}
  
  	// write the authenticated cookie to the response.
  	http.SetCookie(w, cookie)
  	w.Header().Add("Vary", "Cookie")
  	return encodedToken
  }
docs: // save stores encoded CSRF token in the session cookie.