For years, developers have treated Cross-Site Request Forgery (CSRF) as a solved problem. The conventional wisdom was simple: implement a…