It is true. But then, it's an intentional bad design choice by whomever wrote the server. If your server does actions on a GET, or accepts POSTs without a CSRF

It is true. But then, it's an intentional bad design choice by whomever wrote the server. If your server does actions on a GET, or accepts POSTs without a CSRF token protection, that's not the fault of the browser, but a well known behaviour. CORS will solve the javascript/ajax part, BTW.