Anonymous tracking for ajax request validation not possible

drupal_get_token shifts around every request to avoid CSRFs on the /ajax/tincanapi/track path. This path works for authenticated users just fine but anonymous users get a different token each request so it's not possible to do this (via this method). Flags and other modules have implemented https://www.drupal.org/project/session_api in order to make this possible since the session can be linked to something in the database that's stationary.