Also CSRF protection might not be enabled ;)