env will always contain a csrf token after a call to AuthenticityToken#accepts?

Even after "safe" requests.