Browser and server sharing dynamic keys for csrf. Note that it is somewhat incomplete, yet, cabable. I am getting the token through a web request as I was having issues reading cookies and headers due to CORS policies in the browser.