CSRFGenerateOptions.sessionId

Binds the token to the requesting principal (session ID, user ID, or equivalent). A token generated with a sessionId only verifies when the same sessionId is supplied to verify(). Without it, any token issued under the same secret validates for every user.