I proposed something for #kanidm which a reviewer described as "what if CSRF tokens but they hurt to touch"