fix hijacked POSTs (i.e., submitting reviews) when carrier is set (bug 849304)