Except that most webapps are entirely javascript based and thus AJAX nowadays. But I guess we're just conveniently ignoring this? And I'm not talking about cha

Except that most webapps are entirely javascript based and thus AJAX nowadays. But I guess we're just conveniently ignoring this? And I'm not talking about changing anything. On most of my websites if you do a POST without having a session id (which gets assigned on first pageload, a GET), then you are a bot and your POST will be blocked. Byebye. There are many such schemes out there.