func Protect(authKey []byte, opts ...Option) func(*web.C, http.Handler) http.Handler {
	return func(c *web.C, h http.Handler) http.Handler {
		cs := parseOptions(h, opts...)
		if cs.opts.ErrorHandler == nil {
			cs.opts.ErrorHandler = web.HandlerFunc(unauthorizedHandler)
		}
		if cs.opts.MaxAge < 1 {
			cs.opts.MaxAge = 3600 * 12
		}
		if cs.opts.FieldName == "" {
			cs.opts.FieldName = fieldName
		}
		if cs.opts.CookieName == "" {
			cs.opts.CookieName = cookieName
		}
		if cs.opts.RequestHeader == "" {
			cs.opts.RequestHeader = headerName
		}
		if cs.sc == nil {
			cs.sc = securecookie.New(authKey, nil)
			cs.sc.SetSerializer(securecookie.JSONEncoder{})
			cs.sc.MaxAge(cs.opts.MaxAge)
		}
		if cs.st == nil {
			cs.st = &cookieStore{
				name:     cs.opts.CookieName,
				maxAge:   cs.opts.MaxAge,
				secure:   cs.opts.Secure,
				httpOnly: cs.opts.HttpOnly,
				path:     cs.opts.Path,
				domain:   cs.opts.Domain,
				sc:       cs.sc,
			}
		}
		cs.c = c
		return *cs
	}
}
Protect is HTTP middleware that provides Cross-Site Request Forgery
protection.

It securely generates a masked (unique-per-request) token that
can be embedded in the HTTP response (e.g. form field or HTTP header).
The original (unmasked) token is stored in the session, which is inaccessible
by an attacker (provided you are using HTTPS). Subsequent requests are
expected to include this token, which is compared against the session token.
Requests that do not provide a matching token are served with a HTTP 403
'Forbidden' error response.

Example:
package main

import (
"github.com/goji/csrf"
"github.com/zenazn/goji"
)

func main() {
// Add the middleware to your router.
goji.Use(csrf.Protect([]byte("32-byte-long-auth-key")))
goji.Get("/signup", GetSignupForm)
// POST requests without a valid token will return a HTTP 403 Forbidden.
goji.Post("/signup/post", PostSignupForm)

goji.Serve()
}

func GetSignupForm(c web.C, w http.ResponseWriter, r *http.Request) {
// signup_form.tmpl just needs a {{ .csrfField }} template tag for
// csrf.TemplateField to inject the CSRF token into. Easy!
t.ExecuteTemplate(w, "signup_form.tmpl", map[string]interface{
csrf.TemplateTag: csrf.TemplateField(c, r),
})
// We could also retrieve the token directly from csrf.Token(c, r) and
// set it in the request header - w.Header.Set("X-CSRF-Token", token)
// This is useful if your sending JSON to clients or a front-end JavaScript
// framework.
}
package csrf
import (
	"errors"
	"fmt"
	"net/http"
	"net/url"
	"github.com/gorilla/securecookie"
	"github.com/zenazn/goji/web"
)
const tokenLength = 32
const (
	tokenKey    string = "goji.csrf.Token"
	formKey     string = "goji.csrf.Form"
	errorKey    string = "goji.csrf.Error"
	cookieName  string = "_goji_csrf"
	errorPrefix string = "goji/csrf: "
)
var (
	fieldName = tokenKey
	headerName = "X-CSRF-Token"
	safeMethods = []string{"GET", "HEAD", "OPTIONS", "TRACE"}
)
var TemplateTag = "csrfField"
var (
	ErrNoReferer = errors.New("referer not supplied")
	ErrBadReferer = errors.New("referer invalid")
	ErrNoToken = errors.New("CSRF token not found in request")
	ErrBadToken = errors.New("CSRF token invalid")
)
type csrf struct {
	c    *web.C
	h    http.Handler
	sc   *securecookie.SecureCookie
	st   store
	opts options
}
type options struct {
	MaxAge int
	Domain string
	Path   string
	HttpOnly      bool
	Secure        bool
	RequestHeader string
	FieldName     string
	ErrorHandler  web.Handler
	CookieName    string
}