private static function checkCSRF($session_object=null) {
        global $CFG;
        $token = self::wrapped_session_get($session_object,'CSRF_TOKEN');
        if ( ! $token ) return false;
        if ( isset($_POST['CSRF_TOKEN']) && $token == $_POST['CSRF_TOKEN'] ) return true;
        $headers = array_change_key_case(apache_request_headers());
        if ( isset($headers['x-csrf-token']) && $token == $headers['x-csrf-token'] ) return true;
        if ( isset($headers['x-csrftoken']) && $token == $headers['x-csrftoken'] ) return true;
        return false;
    }