Forms: the CSRF token is protected against BREACH attack