CSRF and the cookie the browser sends anyway

A short walkthrough. Replace the placeholder embed from the console.