32 bytes from SecureRandom, as base64url. Public because a test that renders a form outside a request needs one, and a token minted outside a session protects nothing and reveals nothing.
32 bytes from SecureRandom, as base64url. Public because a test that renders a form outside a request needs one, and a token minted outside a session protects nothing and reveals nothing.
