This pull request introduces support for cross-site request forgery protection. This is a pretty important feature to have, so it will be enabled by default. Technically, this is thus a breaking change.

Non-read requests now require a CSRF token to be present. It can be a _token in the request body or in a x-xsrf-token header. All requests will return the CSRF token in a xsrf-token cookie. This pattern is standard across AJAX clients, which means there is no particular setup needed for them.

For standard HTML forms, a <x-csrf-token /> component is available. It renders a hidden _token input. Otherwise, the token is available as the token property of Tempest\Http\Session.

Note that after #1346, we might iterate on this so the cookie can be encrypted, instead of a plaintext UUID.