My sign up page includes Recaptcha and requires a valid Stripe card token, so I can keep that static without worrying about CSRF. However, the sign in page is l

My sign up page includes Recaptcha and requires a valid Stripe card token, so I can keep that static without worrying about CSRF. However, the sign in page is loaded from the Rails app server, and includes a CSRF token. The form submits all go to the Rails app server, which is running on a subdomain. I run a rake task to scrape all of the landing page content from the Rails app, then copy in the static docs site, and upload everything to S3. So it's like I'm using Rails as a static site generator. Basically my root domain is all static files, served from S3 / Cloudflare. And the Rails server is running on an "app" subdomain. I think it's been working pretty well. In the future I might make the whole app static, and just use Rails as an API.