Would it be possible to thwart this attack (BREACH) by issuing fresh CSRF tokens for each requests?