interesting point that CSRF tokens break caching. People can store it in cookie, and not put into the actual HTML.