This type of vulnerability (Silhouette) seems absolutely terrible to protect against. XSRF is bad enough, and now we need dummy pages reloading themselves for basic user privacy? Is the SameSite attribute going to be enough to stop these timing based information leaks?