I have not read the code but this makes perfect sense and I think it’s correct. Note that the token has to be masked because it is again in the body and could be compressed naively.
I know it’s not what you’re asking about but I can’t help but point out that it would be a whole lot easier to just check Sec-Fetch-Site and be done with it rather than pass a token through like four levels of abstraction. Of course this was not possible when the code was written!
