CSRF protection

[lpil]

We want to provide CSRF protection so the programmer does not have to worry about how to implement this security requirement.

Are CSRF tokens still required? Or are SameSite cookie (possibly combined with origin header checking?) enough? The support for SameSite seems good: https://caniuse.com/?search=SameSite

Perhaps CSRF tokens could be a third party library which can be used by teams that need to support older browsers.