Is this a CSRF exploit?