env will always have a csrf token after AuthenticityToken#accepts?

Even after "safe" requests.