I think I can basically 100% automate the csrf token w/ htmx so it feels like from a DX pov it doesn't really matter