code: public static String checkAntiCsrfToken(HttpServletRequest request) throws IOException, ServletException
      {
          if (request.getContentType() != null &&
              request.getContentType().toLowerCase().indexOf("multipart/form-data") > -1 &&
              request.getPart("anti-csrf-token") == null ||
              request.getParameter("anti-csrf-token") == null) {
              return "missing \"" + antiCsrfTokenName + "\" POST parameter";
          }
  
          // SECURITY TODO: Actually validate anti-CSRF token.
          return null;
      }
docs: display that error message to the user.