export async function createCsrfTag(ctx: AppContext) {
	const token = await createCsrfToken(ctx);
	return `<input type="hidden" name="_csrf" value="${escapeHtml(token)}"/>`;
}
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.