CSRF protection without tokens or hidden form fields | Not Hacker News!