function csrf_start()
{
    if ($GLOBALS['csrf']['auto-session'] && session_status() == PHP_SESSION_NONE) {
        session_start();
    }
}
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.