title: CSRF Protection for non form post requests
body: <p>Implementing CSRF tokens in hidden form fields is the standard protection for CSRF for form post requests. </p>
  
  <p>However, how would you implement this for GET requests? Or ajax requests that POST json data instead of x-www-form-urlencoded for the request body? Are these types of things all handled on a case by case ad hoc basis?</p>