I suspect the grandparent is referring to a "cross site request forgery" (XSRF) style attack.