Verifies the request's CSRF token against the session's, throwing on any mismatch.

Exported so a handler or framework action can validate inline — React Router actions conventionally do their own validation rather than relying on middleware. The middleware calls exactly this function, so the two can never disagree.

Reading the body here is safe: every body read is memoized (M87), so the parse is cached and the handler can still read the body afterwards — including a multipart body, which is read now too (M94b) through the same shared accessor the upload middleware uses. The configured header is read first, so a client that sends the token in the header triggers no body read at all.