Good point, I'll work on stripping these where possible. No cookies are obtained and I would hope CSRF tokens expire quickly.