This will be reached only if CSRF protection is not enabled, that does not seem correct :)