It would be nice if all new HTML5 features and APIs release from now on turns on 'Modern Web Security Mode', which fixes CSRF and a bunch of other security issues that are not backwards compatible.