We should require POST on this, to prevent possible XSS.