instance method verified_via_header_only?

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 642
      def verified_via_header_only?
        case sec_fetch_site_value
        when "same-origin", "same-site"
          true
        when "cross-site"
          origin_trusted?
        when nil
          !request.ssl? && !ActionDispatch::Http::URL.secure_protocol
        else
          false
        end
      end