Credit SF/CSRF discovery to Dirk Reimers.