They both return it in the response so the user can always see it.

The example follows csurf’s recommendation which is at http://expressjs.com/en/resources/middleware/csurf.html