Encryption of Sensitive Data
Ensure that the application is free of cross-site scripting issues (CWE-79), because most
CSRF defenses can be bypassed using attacker-controlled script.
Check the HTTP Referer header to see if the request originated from an expected page.