It seems quite possible that CSRF checks could have been omitted in not expecting this to be a source of woe. Just goes to show... :P