public function call() {
		if ( !isset( $_SESSION[self::PARAM] ) ) {
			$_SESSION[self::PARAM] = sha1( session_id() . microtime() );
		}

		$token = $_SESSION[self::PARAM];
		$method = $this->app->request()->getMethod();

		if ( in_array( $method, [ 'POST', 'PUT', 'DELETE' ] ) ) {
			$requestToken = $this->app->request()->post( self::PARAM );
			if ( $token !== $requestToken ) {
				$this->app->log->error( 'Missing or invalid CSRF token', [
					'got' => $requestToken,
					'expected' => $token,
				] );
				$this->app->render( 'csrf.html', [], 400 );
				return;
			}
		}

		$this->app->view()->replace( [
			'csrf_param' => self::PARAM,
			'csrf_token' => $token,
		] );

		$this->next->call();
	}