You might not need a whole iframe. Why not just an img tag like a regular cross site request forgery over GET. If the WHO isn't logged with any js Magic it wil

You might not need a whole iframe. Why not just an img tag like a regular cross site request forgery over GET. If the WHO isn't logged with any js Magic it will work all the same.