This is what I try to do, and I believe it works out well. Sometimes I can tell that someone is a bit annoyed that I'm not showing them just how to add CSRF pro

This is what I try to do, and I believe it works out well. Sometimes I can tell that someone is a bit annoyed that I'm not showing them just how to add CSRF protection to a page, but also why we do it and how it works, but I do believe that showing them how to do it and why is where leaning comes in and trumps raw repetition/memorization.