Neat tricks to bypass CSRF-protection