SSL/TLS: BREACH attack against HTTP compression

[Alexandre Machado]

CheckFormID is a unique identifier (as the name states, each form has its own ID) which is sent in each request and guarantees that the sender is not someone impersonating a legitimate user. IntraWeb will just refuse to process a requests if the FormID doesn't match. This alone is enough to stop most CSRF attacks including BREACH.
Possibly you just need to explain this to the auditors.