Rather than making a view that returns a token, can the token be stored in the HTML that's sent to the browser, and picked up there?