Form hijack is protected