https://redbeardsec.com/how-to-understand-and-prevent-cross-site-request-forgery/