Yeah, we should add a `GET` endpoint for getting the CSRF token instead. I was reasoning wrong before about why we shouldn't do that.