Isn't this solved by just requiring the CSRF token on any JS get requests? (In fact, isn't this just a cross-site request forgery with a different verb than we're used to?)

I know it's only generally checked on posts, but turning it on for any xhr calls seems like it would solve any potential data leakage.