pub const CSRF_FIELD: &str = "_csrf";
The form field and the header a token may arrive in. _csrf is the one csrf_lock already requires of every state-changing <form>; the header is how a scripted fetch sends one.
_csrf
csrf_lock
<form>
fetch