Aren't you protected if you just use csrf tokens on sensitive POSTs? I thought it was good practice to always do that anyways.