CSRF:
- Check if the token is present on any form it should be
— ONLY Create, Update and Delete forms should have CSRF tokens
- Server checks if the token length is correct
- Server checks if parameter is there
- Server accepts empty parameter
- Server accepts responds without CSRF token
- Token is not session bound