Saving world from CSRF code execution