Nice and easier than nonce tokens, particularly when you're partial view caching etc. - but until all current and old browsers that don't support the new attrib

Nice and easier than nonce tokens, particularly when you're partial view caching etc. - but until all current and old browsers that don't support the new attribute die out it's going to be necessary to continue doing things the old (current) way - users using older browsers are more likely to be hit by CSRF and other attacks as they tend to be more technically naive and actually click phishing emails/popups etc.