Prevent request forgery exploit in card.dm