Why not just use a simple csrf stored in a session? You already have an "authenticiy_token" in the request data, why not use it, or add another value for csrf?