CSRF attacks can be simple