code: public function getCsrfToken($regenerate = false)
      {
          if ($this->_csrfToken === null || $regenerate) {
              if ($regenerate || ($token = $this->loadCsrfToken()) === null) {
                  $token = $this->generateCsrfToken();
              }
              // the mask doesn't need to be very random
              $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-.';
              $mask = substr(str_shuffle(str_repeat($chars, 5)), 0, static::CSRF_MASK_LENGTH);
              // The + sign may be decoded as blank space later, which will fail the validation
              $this->_csrfToken = str_replace('+', '.', base64_encode($mask . $this->xorTokens($token, $mask)));
          }
  
          return $this->_csrfToken;
      }
docs: Returns the token used to perform CSRF validation.
  
  This token is a masked version of [[rawCsrfToken]] to prevent [BREACH attacks](http://breachattack.com/).
  This token may be passed along via a hidden field of an HTML form or an HTTP header value
  to support CSRF validation.
  @param boolean $regenerate whether to regenerate CSRF token. When this parameter is true, each time
  this method is called, a new CSRF token will be generated and persisted (in session or cookie).
  @return string the token used to perform CSRF validation.