> The only problem is that HTTP-based caching requires sane server URLs This works great insofar as you aren't bound by PCI requirements; per PCI, you cannot t

> The only problem is that HTTP-based caching requires sane server URLs This works great insofar as you aren't bound by PCI requirements; per PCI, you cannot transmit potentially sensitive data in a GET request, and so basically every request must be a POST. Furthermore, implementing CSRF via GET is a non-starter -- that's not even an option.