@dsandler @shawnr true -- it's not quite XSRF. But you do have to hold a cookie for it to work! Better explanation: http://is.gd/gyfn