The problem with that is that to require instantiation of any form just to check csrf means loading resources that form needs. In this case, it's all user policies, so I felt it better to avoid that.