Move rule should have some CSRF protection
Remove the dots from the link hashes
Add user warning flag