CSRF double-submit cookie validation

Validate a CSRF double-submit-cookie defense. Given the token value from the cookie, the token value submitted in the request (header or form field), and a set of HTTP methods considered safe (e.g. ['GET','HEAD','OPTIONS']), return True if the request should be allowed. Safe methods are always allowed regardless of tokens. For unsafe methods, both tokens must be present (non-empty) and equal under a constant-time comparison. Return False otherwise.