POST alone isn't sufficient. You need CSRF protection, too (which, in this case, would protect from same-site request forgery).