Users and anonymous forms

I'm using varnish and have a couple of exiting modules which do searching. The way that they work is, using forms api, drupal_goto('mysearch/search+terms').

Here's the rub. I have to patch both core and these modules to keep them working with varnish. If I don't I get the notorious "This form is outdated. Reload the page and try again" message. I understand why—the form token is cached in the body of the document, and fails to validate for additional users. I'm a bit at a loss on the best solution for this.

According to the form api, setting $form['token'] = FALSE will skip the CSRF prevention and allow the same cached page to be submitted several times. This isn't ideal, and it also doesn't work without this diff in form.inc:

I don't know if this was by design or an accident. Uid 0, our user in question can never make that clause succeed.

Another option, which is what the contact module uses, not to let the page be cached. This isn't really an option for us since these modules provide blocks which are on every page.

The only other thing I can come up with is to revise the modules such that they use http get instead of fapi/drupal_goto. This isn't much better in my opinion, but would work since they would be html forms.

I hope there's an option I'm missing which "just works". Thank you.