code: async function( req, res, next ) {
      try { 
        var csrfToken = 'default'
        if ( req.cookies && req.cookies[ 'pong-security' ] ) {
          var token = req.cookies[ 'pong-security' ]
          if ( gui.getCsrfTokenForUser ) {
            csrfToken = await gui.getCsrfTokenForUser( token )
          } else if ( gui.userTokens[ token ] && gui.userTokens[ token ].csrfToken ) {
            csrfToken = gui.userTokens[ token ].csrfToken
          }
        }
      } catch ( exc ) { log.warn('easy-web-app CSRF token, exc') }
      res.header( 'X-Protect', csrfToken );
      next();
    }
docs: inject CSRF token