fix: CSRF flow ships the raw token, not the HMAC cookie

tests/Unit/Http/MatchActionSupportTest.php

@@ -47,7 +47,7 @@ final class MatchActionSupportTest extends TestCase
             match: $this->validMatchArray(),
             csrf: $csrf,
             turnToken: $badToken,
-            cookies: ['__csrf' => $cookie],
+            cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
         );
 
         $result = $support->verify($request);
@@ -66,7 +66,7 @@ final class MatchActionSupportTest extends TestCase
             match: ['this' => 'is not a match'],
             csrf: $csrf,
             turnToken: 'whatever',
-            cookies: ['__csrf' => $cookie],
+            cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
         );
 
         $result = $support->verify($request);