This looks wide open to csrf attacks.

Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user.

Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".