This post confirms CSRF vulnerability