sometimes in the form of a question that required more
investigation: Bill Heinbockel, Chris Wysopal, and Mark Curphey.
Thanks to Jeremiah Grossman, Andrew van der Stock, RSnake, and
Jeff Williams for their feedback on CSRF detection.