If you are experiencing the following error:
"The link you followed isn’t valid. This page requires a CSRF confirmation token. Report this error to your Salesforce administrator."
This is because the Visualforce Page you are navigating to has the metadata checkbox turned on:
If you are looking to get your App Security Reviewed, you will need to enable these tokens for each Visualforce page you are navigating to through a web link.
We had a bit of a different pattern:
Then in the body we ensure we are generating "well-formed URLs" using URLFOR.