I don't think this should be enabled by default, for CSRF reasons.