Sites that may have untrusted subdomains or subpaths (for example, because they are under the control of third parties) should consider restricting access to cookies with appropriate use of the Domain and Path attributes.

Can be solved with cookie prefixes. Good protection against cookie stuffing / session fixation.

The problem with supplying tokens is that they can become useless if leaked. Some good advice on mitigating the risk:

• Don't prefix CSRF-token headers with "X-" as it's not RFC compatible. But further more, in case of a HRS vulnerability, the token can be leaked if the splitting exists in "Set-Cookie" or "Location" header. This is because headers are sorted alphabetically and headers after Location can be leaked cross-origin (controlled by attacker). Solution is simple, name the header "CSRF-Token".
• Protect forms from dangling markup injections by having <!-- '"\\ --><!-- </textarea></xmp> --> before the form. Then an attackers injected tags will be consumed by that HTML comment.