csrf = request.params.get('csrf_token')
if (request.method == 'POST' or request.is_xhr) and (user and user.
    is_authenticated()) and csrf != str(request.session.get_csrf_token()):
    pass
How do you add csrf validation to pyramid?