Cacheable CSRF protection