The CSRF filter/token mechanism only supports authenticated users. So, If you are hosting a static site without any login functionality, you can remove the token call.Note that the Sling Referrer Filter offers a second layer of CSRF protection which works in all cases, authenticated or not. See Slin...