title: JWT for CSRF protection on unauthenicated endpoints?
body: <p>I have a load of api endpoints that I want to protect from CSRF. I'd like to do this in a stateless way, so naturally JWT comes to mind.</p>
  
  <p>The problem is, these endpoints do not require the user to be logged in. </p>
  
  <p>So, my problem is, I can use JWT, but I have no way of verifying the token on the server side -- I have no logged in user I can match it to.</p>
  
  <p>Is there any way JWT can be used in such cases?</p>