export async function createCsrfToken(ctx: AppContext) {
	if (!ctx.joplin.owner) throw new Error('Cannot create CSRF token without a user');
	return ctx.joplin.models.token().generate(ctx.joplin.owner.id);
}
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.