Package csrfguard.js in JAR and look there by default