Function createCsrfGuard

The acceptance rule.

• A foreign Origin / Referer is rejected outright, token or no token. A foreign origin is positive evidence that a browser made this request from another site; the pre-#272 guard already rejected it and a security fix must not hand that back. A legitimate non-browser client simply sends no Origin, so nothing that worked before is lost.
• A same-origin or trusted signal is accepted on its own. This is what keeps the ordinary browser login form working with no client change.
• When no origin signal is present — the header-less API client, and the exact case the old code waved through — a valid double-submit token is required.

So the two arms are alternatives for presence, and the origin arm is authoritative when it is present. Rejection happens when both are missing, or when either positively contradicts the request.