Maybe you should do something other than alert() the CSRF exploit, I can't copy it under Windows