code: function getCsrf (opts) {
    // for testing
    if (opts._simulateMaintenance) {
      return new Promise((resolve, reject) => {
        setTimeout(() => {
          reject(new Error('Could not find CSRF token'))
        }, 300)
      })
    }
  
    return fetch(`${opts.host}/_/mobile/init`, json(opts))
      .then((response) => props({
        csrf: getJSON(response).then((body) => body.data[0].c),
        session: getSessionCookie(response.headers.get('set-cookie'))
      }))
  }
docs: Get a CSRF token and session cookie for logging into plug.dj from their main page.  Without the CSRF token, login requests will be rejected.