that it is currently not easy to detect automatically. The dearth
of CSRF in CVE suggests that non-contract researchers are
simply not investigating this issue. If (and when) researchers
begin to focus on this issue, there will likely be a significant