Yeah, but you only check form auth on a POST. In this case, if I submit to this page a GET request like `/feeds/list?action:addcustom=1&url=blahblah` then it will completely skip the form auth check, the userid check, and go straight in to the logic to add a custom feed.