CSRF protect the move actions