Lazy CSRF on page file re-upload form (visited often)