I'm thinking more elaborate CSRF tokens that uses subresource integrity and everything else (cookies, headers, etc). As soon as there's a mismatch, collect details and report.