CSRF protection is indeed a must have. However it can be extremely invasive (at least my experience with RubyOnRails tell me so). Thus, it should be definitely part of another card.