code: protected function createCsrfCookie($token)
      {
          $options = $this->csrfCookie;
          $options['name'] = $this->csrfParam;
          $options['value'] = $token;
          return new Cookie($options);
      }
docs: Creates a cookie with a randomly generated CSRF token.
  Initial values specified in [[csrfCookie]] will be applied to the generated cookie.
  @param string $token the CSRF token
  @return Cookie the generated cookie
  @see enableCsrfValidation