[ptman]

you might not need more advanced csrf protection than a cookie samesite policy.

[zadokshi]

Then throw a hidden input field with a CSRF token in your form and your done.

Not sure what the big deal is here.