Don't do actions on `GET`. Use `POST`, you'll get CSRF protection.