CSRFVerifyOptions.sessionId

The principal (session ID, user ID, or equivalent) the token must be bound to. A token generated with a sessionId only verifies when the same sessionId is supplied here; a token generated without one only verifies when this option is omitted.