In the desktop case this didn't actually matter... The attacker could have just as easily made a POST form with hidden fields that it then submitted to FB. Requ

In the desktop case this didn't actually matter... The attacker could have just as easily made a POST form with hidden fields that it then submitted to FB. Requiring POSTs for write-based end points is a good start, but there's a ton more necessary to keep API endpoints safe.