$applicable_requirements = [
'_csrf_request_header_token',
- // @...

$applicable_requirements = [
'_csrf_request_header_token',
- // @todo Remove _access_rest_csrf in Drupal 9.0.0.
- '_access_rest_csrf',
];

will used by

if (array_intersect($applicable_requirements, $requirement_keys)) {

and first argument is array.So can we can kept in array.