It would be nice to change CSRF token Bad Request messages into something that tells users to 'please try again'.