I mean CSRF, not XSS >_>