code: def xhr(func):
      
  
      """
      @apiDefine csrf
      @apiHeader {string="application/json"} Content-Type
          The content type must be set to `application/json` to prevent CSRF attacks.
      """
  
      def dec(self, env, req, *args, **kwargs):
  
          if req.content_type and not req.content_type.startswith("application/json"):
              raise Forbidden("CSRF")
          return func(self, env, req, *args, **kwargs)
  
      return dec
docs: A decorator to check for CSRF on POST/PUT/DELETE using a <form>
      element and JS to execute automatically (see #40 for a proof-of-concept).
  
      When an attacker uses a <form> to downvote a comment, the browser *should*
      add a `Content-Type: ...` header with three possible values:
  
      * application/x-www-form-urlencoded
      * multipart/form-data
      * text/plain
  
      If the header is not sent or requests `application/json`, the request is
      not forged (XHR is restricted by CORS separately).