This is exactly what the parent suggests doing. Keep in mind that if you don't change the client's view of the token on every page load (using some kind of sal

This is exactly what the parent suggests doing. Keep in mind that if you don't change the client's view of the token on every page load (using some kind of salt), you are potentially vulnerable to CRIME/BEAST.