KemalIdentity::CSRFError
Inherits KemalIdentity::Error < Exception < Reference < Object
Raised when a state-changing request carries no valid CSRF token. Mapped to 403.
This extends the taxonomy in src/CLAUDE.md by one class, deliberately: a CSRF rejection
is neither "not authenticated" (the caller may well be) nor "not fresh enough" (their
authentication is fine), and collapsing it into either would make the two existing classes
mean less. See blueprints/0009-csrf-token-scheme.md.