1. Embed an ephemeral encrypted token (https://owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF...) in the HTTP response header that's signed with an HMAC-SHA-256 signature.

2. Sign sensitive requests similar to how Amazon does for AWS API requests (http://docs.aws.amazon.com/general/latest/gr/signing_aws_api...) -- just make sure your signature is secure (http://www.daemonology.net/blog/2008-12-18-AWS-signature-ver...).

3. Use client-side certificates by using the HTML5 keygen element to have the browser generate the client's public/private key pair, and then have the server sign the client's public key (http://security.stackexchange.com/questions/27961/should-the...).

4. All of the above.