Add the cors-csrf module

cors-csrf/docs/output/11-spa-ordering.txt

@@ -0,0 +1,24 @@
+==============================================================================
+docs/output/11-spa-ordering.txt
+.csrf(c -> c.csrfTokenRepository(custom).spa()) - the custom repository asked for a cookie
+named MY-CSRF and a header named X-CSRF-TOKEN. Neither reaches the running application.
+Profile: spaorder
+==============================================================================
+
+HTTP/1.1 200 
+Vary: Origin
+Vary: Access-Control-Request-Method
+Vary: Access-Control-Request-Headers
+Set-Cookie: XSRF-TOKEN=<token>; Path=/
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+
+# cookie jar:
+
+localhost | FALSE | / | FALSE | 0 | XSRF-TOKEN | 42573eea-76d6-4bc6-a14b-bff76640461d
+
+# spa() assigns csrfTokenRepository and requestHandler unconditionally; it is not a
+# 'defaults if unset' method. Swap the two calls and MY-CSRF appears.