OK. I moved it to the CsrfProtection class.