Here we go again. Just require POST requests with a CSRF token for upvotes...