Function with_csrf_meta 

pub fn with_csrf_meta(document: &str, token: &str) -> String

document carrying the visitor’s CSRF token in its head, as <meta name="csrf-token"> — what the server writes into every page it composes under a ## Session, and what the browser host (runtime.js’s requestHeaders) sends back as x-csrf-token on the page’s state-changing requests to its own server. The meta opens the head; a page’s own Head: merges over it by identity like every other head element. A document with no <head> is returned as it is.