I think Jakub P. was implying that the CSRF-token defense could also guard against this attack.