At the moment, cached forms (e.g. views exposed filter) will all have the same CSRF token generated at the first cache miss. That means CSRF protection provided by Drupal becomes useless. We have to handle per-user CSRF tokens inside cached forms.