CSRF: string | null | () => Promise<string>