Stateless XSRF protection with PHP