Do you think we can say: `If the user was identified by a cookie, we must check CSRF`? In this case, our code that puts a user in context based on the cookie session can apply `_checkCSRF = true` and no one else would have to worry about it.