[the_mitsuhiko]

It's a transaction bound short lived one time token. Nothing you can replay.

[Natanael_L]

The memorable message isn't.

[the_mitsuhiko]

Sure, but that memorable message is not really all that useful on a non SSL page, but it's also not particularly important from a security point of view.