Another interesting point is the generation of unique IDs that weren't cryptographic. The uid in src=<uid> shouldn't be guessable, right? It looks like it jus

Another interesting point is the generation of unique IDs that weren't cryptographic. The uid in src=<uid> shouldn't be guessable, right? It looks like it just went a simple transformation that was easily reversible. On the other hand, if the CSRF tokens were validated, the uid field needn't be guessable.