Implementing an anti-CSRF token is the most effective control for mitigating cross-site request forgery attacks. It ensures that a unique token is associated with every user session and must be submitted with every state-changing request, making it highly unlikely for an attacker to forge a valid request. Captcha is not as effective because it is typically used for different purposes like distinguishing human users from bots. Re-authentication before action addresses security concerns but would not specifically prevent CSRF attacks, and increased session timeout may actually increase the risk of CSRF by prolonging the window in which an attack can occur.