WORSHIP HYMN — CSRF PROTECTION INSTALLATION
=============================================

1. Copy config/csrf.php into your existing config/ folder.

2. Add this line to config/config.php after session_start():

   require_once __DIR__ . '/csrf.php';

3. Every state-changing POST form must contain:

   <?= csrf_field(); ?>

4. Every POST handler that changes data must begin with:

   require_csrf();

5. Keep authorization checks separately.
   CSRF protects against forged requests; it does NOT decide whether
   the logged-in user is an administrator.

6. For admin actions, require BOTH:
   - require_csrf()
   - an admin authorization check

7. The supplied authenticate.php verifies the CSRF token before
   processing login and rotates the session ID/token after success.

8. The supplied logout.php destroys the session and cookie.

IMPORTANT:
Do not only protect the dashboard. Protect every POST endpoint that
creates, edits, deletes, uploads, changes settings, changes passwords,
manages users, songs, categories, verses, notifications, sliders,
gallery items, messages, etc.

GET requests should not perform destructive actions. Change delete
operations to POST forms with csrf_field().

Existing config.php already had csrf_token()/verify_csrf() helpers in
the code you provided. Do not define duplicate functions. Prefer the
central config/csrf.php implementation and remove duplicate definitions
if both are installed.

Testing:
- Open the login page and submit normally: it should work.
- Remove/change csrf_token from a POST request: it should return HTTP 419.
- Login successfully: session ID and CSRF token rotate.
- Logout: session is destroyed.
