Is it unsafe for the JavaScript client to set the CSRF token? | Hacker News Reader