It's still amazingly easy to exploit through phishing, etc. Sending an email with a link to a controlled page, etc could easily get an authorized user to send t

It's still amazingly easy to exploit through phishing, etc. Sending an email with a link to a controlled page, etc could easily get an authorized user to send the web request.