sessionless csrf with origin check, falling back to cookie based hmac token when origin is not present
