Say you have an application that is being served out of a Node instance, a CSRF token is applied in a cookie and all requests from the client must contain that token to be accepted.
If you're using a PM2 cluster, or your application is part of an AWS auto-scale group and where you are unable to guarantee that the request will go to the same server where the token originated, what happens and how do you manage that?