public function verify(string $_csrf = null, callable $callback = null): bool
    {
        if (!isset($_csrf)) {
            $_csrf = (string) $_REQUEST['_csrf'];
        } // Defaults to current request.

        if ($this->c::isActiveSession()) {
            if (empty($_SESSION['_csrf'])) {
                return false; // No token.
            }
            return $this->c::hashEquals($_SESSION['_csrf'], $_csrf);
        }
        throw $this->c::issue('No verification handler.');
    }