Cross-Site Request Forgery is dead
Not supported on most browsers, as opposed to what the headline suggests: <a href="http://caniuse.com/#feat=same-site-cookie-attribute" rel="nofollow">http://caniuse.com/#feat=same-site-cookie-attribute</a>