An unguessable random string. It is used to protect against cross-site request forgery attacks.