Yeah, I wanted to get your opinion on this. I was thinking in the case where you're authenticating and using your API for multiple purposes. My logic being that if you're building separate programs outside the browser, you wouldn't want CSRF headers or cookies being generated. 

Thought was "X-API-Key" was a pretty standard header name to use, and if that was used in the request it wouldn't need to have a CSRF token generated and returned. 

If we decide to keep this functionality, I'll update the documentation. What are your thoughts, should it be removed? Should we have this be an option passed in during creation? 

Thinking about it, it may better to recommend and provide guidance around building your own middleware functions to possibly strip the headers/cookies after Generate. Reason being that in order to have Validate on requests serving up similar functionality, a user will have to write their own function to skip validate if "X-API-Key" exists and is valid. We could also put an if statement in Validate.