Bugfix: disable the hidden field for the SVG image, so as to prevent it
from being resubmitted - a trigger for chrome to think it's a cross site
javascript attack. (Error seen: The XSS Auditor refused to execute a
script in 'http://www.somedomain.com/event/action' because its source
code was found within the request. The auditor was enabled as the server
sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy'
header.)