    public function testSettingCookie()
    {
        $_SERVER['REQUEST_METHOD'] = 'GET';

        $controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
        $controller->request = new Request(['webroot' => '/dir/']);
        $controller->response = new Response();

        $event = new Event('Controller.startup', $controller);
        $this->component->startup($event);

        $cookie = $controller->response->cookie('csrfToken');
        $this->assertNotEmpty($cookie, 'Should set a token.');
        $this->assertRegExp('/^[a-f0-9]+$/', $cookie['value'], 'Should look like a hash.');
        $this->assertEquals(0, $cookie['expire'], 'session duration.');
        $this->assertEquals('/dir/', $cookie['path'], 'session path.');

        $this->assertEquals($cookie['value'], $controller->request->params['_csrfToken']);
    }
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.