[nilobject]

I have my phpMyAdmin installed only on my secure site, behind HTTP authentication as well.

[rcoder]

If you're using HTTP Basic auth, your browser will happily cache the credentials and re-submit them every time when asked for the same server/realm combination. You'll need to restart your browser to clear the cached auth data.

[simonw]

The reason CSRF is scary is that it works against those defences.