I have to deeply studied this problem. Normally I would prefer using Django's form API and send form data via POST not GET. Then we have also CSRF-Protection, I think. But I am not sure.