Assertion: request | /r/Causes | state changes
Facets:
Source sentences:
text: The anti-CSRF token can be added as a hidden field for forms or within URLs (only necessary if GET requests cause state changes, that is, GET requests are not idempotent)