title: Avoiding CSRF tokens
body: <p>I have a scenario where I already have CSRF tokens, but I have to remove. On an ecommerce, the product page is cached by Varnish, so if the user lands directly here, he won't have a session ID to validate the token. In this page I have a "add to cart" button which have the CSRF token, but of course it's cached with the wrong token.</p>
  
  <p>My question is: there is another way to have a CSRF protection without relying on a input hidden with the token? The page where the button is placed must be cached, so tokens in this case aren't good.</p>
  
  <p>Thanks.</p>