Do we want to base the CSRF token on values provided by the client? The document root is the same on lots of sites since many use the default Apache or Nginx config, so that's quite guessable, and the other two values may be able to be tampered with directly.