Introducing cross-site request forgery