code: @Override
      public String extractTokenFromRequest(Context context) {
          // First check the tags, this is where tokens are added if it's added to the current request
          // In that case, the request scope contains the token
          String token = (String) context.request().data().get(TOKEN_KEY);
          if (token == null && getCookieName() != null) {
              // Search in a cookie
              Cookie cookie = context.cookie(getCookieName());
              if (cookie != null) {
                  token = cookie.value();
              }
          }
          if (token == null) {
              // Check in the session
              token = context.session().get(getTokenName());
          }
  
          if (token != null && isSignedToken()) {
              // Extract the signed token, and then resign it. This makes the token random per request, preventing
              // the BREACH vulnerability
              return crypto.signToken(crypto.extractSignedToken(token));
          } else {
              return token;
          }
      }
docs: Extracts the token from the request. This implementation checks in the request data, then in the CORS cookie
  if any, and finally in the session cookie. If the token is signed, it resigns it to avoid the BREACH
  vulnerability.
  
  @param context the context
  @return the extract token, {@code null} if no token.