this needs to be passed in calls from the client so that it can be compared on the server against the value in the secure cookie. i think this should be [available in `request.plugins.crumb`](https://github.com/hapijs/crumb/blob/86309f6babee77f9dfe115dde95bd9e1b755c902/lib/index.js#L173)