Hacker News Reader

I believe that would be the point of <meta http-equiv="X-Frame-Options" content="deny">

That's like trying to duct tape your arm back on after losing a fight with a chainsaw.

"X-Frame-Options" is used to defend against click-jacking attacks, not to defend against CSRF.