See this too: https://supertokens.io/docs/session/common-customizations/sessions/anti-csrf