Hacker News Reader

You need to store some kind of state if you want to protect the form from CSRF attacks. You usually want to protect the form.

You don't need a cookie for that though... Even a window variable would suffice