    def check_xsrf_cookie(self):
        """Check that xsrf cookie matches xsrf token in request"""
        # overrides tornado's implementation
        # because we changed what a correct value should be in xsrf_token

        if not hasattr(self, "_jupyterhub_user"):
            # run too early to check the value
            # tornado runs this before 'prepare',
            # but we run it again after so auth info is available, which happens in 'prepare'
            return None
        return check_xsrf_cookie(self)
Check that xsrf cookie matches xsrf token in request
jupyterhub/handlers/base.py