This should *NOT* be a get :). And it should use the antiforgerytoken and it needs to require auth.