Strategy for reading the actual CSRF token from the request

[rwinch]

Summary

Currently the CsrfTokenRepository allows loading the expected CsrfToken from the request. It would be nice if the actual CSRF token could be a strategy that could be replaced.

Related gh-7537 gh-7538