since we're adding new stuff here `req.csrfToken()` or something might be nice, reads kind of bad with camel-case but hey