This was created without any CSRF token protection