CSRF protection, post url instead of get, starred page, all that shit.