Defeating Cross-Site Request Forgery Attacks with Browser-Enforced Authenticity Protection