Fully confirmed CSRF - no token, no auth required