# Session-backed tokens: the app has no JavaScript for the stateless double-submit flow.
framework:
    form:
        csrf_protection:
            token_id: submit

    csrf_protection: true