Scenario 17: A user leaves a form open in a browser tab for over an hour, then submits it, and gets an unexplained 403 error.

The CSRF token tied to their session/page load has likely expired or been rotated server-side by the time of submission, so the token the browser is sending no longer matches what the server expects. Rather than showing a raw, confusing 403, handle this gracefully client-side: detect the specific CSRF-failure response and prompt the user to refresh the page (fetching a new token) before resubmitting.