Tokens and block cache
But, how does it work when Full Page Caching is enabled? Same problem, right?
I'm curious how other devs solve this problem. Disabling FPC just to generate a token seems wrong, and removing the token seems wrong too.
If you really need to fully cache the page, then you could either iframe or ajax load the part that cannot be cached. The disadvantage is that would no longer get indexed by Google.