Security: Prevent abuse of server script

Implement a mechanism that should prevent third party web sites to
abuse the server script from sending out spam e-mails from the user's
Gmail account. The mechanism works by generating some random code on
the server side in response to the initial dummy GET request. This
random code is communicated to the client thru a channal that can
only be read by priviliged JavaScript code. In the subsequent POST
request, the client has to send the code back to the server, which
will compare the code to its cached version. No additional HTTP
round trip is required.