code: protected function loadCsrfToken()
      {
          if ($this->enableCsrfCookie) {
              return $this->getCookies()->getValue($this->csrfParam);
          } else {
              return Yii::$app->getSession()->get($this->csrfParam);
          }
      }
docs: Loads the CSRF token from cookie or session.
  @return string the CSRF token loaded from cookie or session. Null is returned if the cookie or session
  does not have CSRF token.