def METHOD_NAME(resp):
    """
    Sets a new CSRF protection cookie to the response. The backend should call
    this function every time it serves the index endpoint (`index.html`), in
    order to refresh the cookie.
    - The frontend should be able to read this cookie: HttpOnly=False
    - The cookie should only be sent with HTTPS: Secure=True
    - The cookie should only live in the app's path and not in the entire
      domain. Path={app.prefix}
    Finally, disable caching for the endpoint that calls this function, which
    should be the index endpoint.
    """
    cookie = secrets.token_urlsafe(32)
    secure = settings.SECURE_COOKIES
    if not secure:
        log.info("Not setting Secure in CSRF cookie.")
    samesite = os.getenv("CSRF_SAMESITE", "Strict")
    if samesite not in SAMESITE_VALUES:
        samesite = "Strict"
    resp.METHOD_NAME(key=CSRF_COOKIE, value=cookie, samesite=samesite,
                    httponly=False, secure=secure,
                    path=current_app.config["PREFIX"])
    # Don't cache a response that sets a CSRF cookie
    no_cache = "no-cache, no-store, must-revalidate, max-age=0"
    resp.headers["Cache-Control"] = no_cache