1. A method of communicating between a client machine and a server in an active web browsing session, the method comprising: transmitting, during an active web browsing session between a web browser of a client machine and a website provided by a server of a first network domain, the active web browsing session being a time during which communications are established between the client machine and the server for exchanging information, a security token message from the server to the client machine, the security token message including a first security token, the first security token comprising a first browser session identifier that identifies the active web browsing session, the first security token further comprising a first action request identifier associated with a first action request message configured to be sent from the client machine to the server to request that an action be performed on the server to modify information stored by the server, wherein the security token message is transmitted to the client machine without storing the first security token in a persistent storage location on the server; receiving, during the active web browsing session, a second action request message including a second action request identifier at the server, the second action request message further including a second browser session identifier of the active web browsing session and a second security token, the second security token including a first identifier and a second identifier, the first and second identifiers of the second security token being different from each other, the second action request message transmitted in association with the active web browsing session; comparing the first identifier of the second security token to the second browser session identifier and comparing the second identifier of the second security token to the second action request identifier of the second action request message, wherein the second security token is validated without performing a server database query; and performing the requested action in response to the first identifier of the second security token matching the second browser session identifier and the second identifier of the second security token matching the second action request identifier.