title: Why CSRF token should be in meta tag and in cookie?
body: <p>What's the need of to put CSRF token name and value inside <strong>&lt;head&gt;</strong> tag using <strong>&lt;meta&gt;</strong> like:</p>
  
  <p><strong>e.g:</strong></p>
  
  <pre><code>&lt;meta content="authenticity_token" name="csrf-param" /&gt;
  &lt;meta content="4sWPhTlJAmt1IcyNq1FCyivsAVhHqjiDCKRXOgOQock=" name="csrf-token" /&gt;
  </code></pre>
  
  <p>I've read about concept to keep CSRF value in cookie but does not find about why to keep inside <strong>&lt;head&gt;</strong> tag.</p>