def add_token_to_response(response, csrf_token=None):
    if csrf_token:
        # Don't set httponly so that we can POST using XHR.
        # https://github.com/gratipay/gratipay.com/issues/3030
        response.set_cookie(b'csrf_token', csrf_token, expires=CSRF_TIMEOUT, httponly=False)
Store the latest CSRF token as a cookie.
dataset/ETHPy150Open gratipay/gratipay.com/gratipay/security/csrf.py/add_token_to_response