Clojurians Log v2

I’m planning to use the pedestal sessions to enable its csrf mitigation, and am confused by this: https://github.com/pedestal/pedestal/blob/master/service/src/io/pedestal/http/ring_middlewares.clj#L194-L196

If this is a necessary step, why doesn’t this interceptor do it in its :enter fn, and tell anyone downstream to update the :session in the response if they want to make changes?

Moreover, if persisting :session/key is necessary, why doesn’t the https://github.com/pedestal/pedestal/blob/master/service/src/io/pedestal/http/csrf.clj interceptor do so?