add HttpHeaderCSRFStoragePolicy

[silenius]

Add a HttpHeaderCSRFStoragePolicy to persists the CSRF token in an HTTP header.
While here, also replace uuid.uuid4() with secrets.token_hex() for the token factory

[luhn]

This CSRF policy pulls from request.headers['X-CSRF-Token'] by default and check_csrf_token (the module-level function) pulls from the same, so it ends up a tautology.

[silenius]

that's right, I missed that..! is using a different key in the CSRF policy an acceptable solution or too fragile?

[luhn]

Hard to say, I don't really understand where or how one might use this policy. Can you give a sample use case?

[silenius]

I just want to store the CSRF token in an header rather than in the session or in a cookie. I'm using JWT tokens and it is often recommended to store the JWT token in a secure onlyHTTP same-site cookie and the CSRF token in header