https://unaaldia.hispasec.com/2008/06/cross-site-request-forgery-en-plone-3-0-x.html