CSRF Protection Without Tokens or Hidden Form Fields | Not Hacker News!