CSRF exploit. If you know the username of the logged in user, you can have them vote up any story since the URL just takes the username of the voter. To my know

CSRF exploit. If you know the username of the logged in user, you can have them vote up any story since the URL just takes the username of the voter. To my knowledge, that exploit still exists.