[mattbasta]

There's a CSRF token in the form, but deleting it doesn't seem to cause the search to fail.

[tekacs]

It's a search form.

It seems quite possible that CSRF checks could have been omitted in not expecting this to be a source of woe. Just goes to show... :P