This would be the most trivial CSRF attack of 2019

Goddamn, moderators, put a fuxking cert on your site. Let's encrypt is *free*.