Comment by koudi

Why not generate token on client and only submit that?