private static function __csrf()
{
// csrf
if ($session = X::getRegisterObj('session')) {
if ($token = $session->get('__csrf')) {
if (X::request()->post(['__csrf'])->__csrf != $token) {
if ($fn = X::getMap('csrf')) {
$fn();
exit;
} else {
X::abort('CSRF defense!');
}
}
}
}
}