Constant SESSION_NONCE_FIELD 

pub const SESSION_NONCE_FIELD: &str = "__csrfnonce";

The hidden field every session carries, whether the author declared it or not: the value a visitor’s CSRF token is derived from.

★ A NONCE RATHER THAN THE SESSION’S CONTENTS, and the difference is the whole protection. Deriving the token from the fields would hand every ANONYMOUS visitor the same token — they all carry the same empty session — and a token every visitor shares is one an attacker reads off their own page. It is minted the first time csrf() is called on a visit, which is the moment a page needs one and not before, so a visitor who never sees a form is never given a cookie.