This is a handy defence-in-depth mechanism, somewhat like the other cookie flags (httpOnly and secure). Once browser support gets a bit better, it would seem l

This is a handy defence-in-depth mechanism, somewhat like the other cookie flags (httpOnly and secure). Once browser support gets a bit better, it would seem like a good idea to start making use of it on that basis, but I don't think I'd ever rely on it as the only form of CSRF protection on a site...