title: Adobe CQ 5 Accepts Arbitrary POST Request
body: <p>i know that Adobe CQ 5 was built on top of Apache Sling (which using JackRabbit). I'm a bit baffled as for why the website will accept arbitrary POST request from outside (unauthenticated user) into Publish Instance through the Dispatcher and then reply with HTTP 200 Content Updated. Should not content update only allowed from Author Instance in this case? Should not such request met with HTTP 403 response instead? - Why is it that even not logged in can get HTTP Response 200?</p>
  
  <p>The response looked like this:</p>
  
  <pre><code>    {
          "changes": [],
          "referer": "http://www.example.com/content/somesite/en.html",
          "path": "/content/somesite/en",
          "location": "/content/somesite/en",
          "parentLocation": "/content/somesite",
          "status.code": 200,
          "status.message": "OK",
          "title": "Content modified /content/somesite/en"
      }
  </code></pre>
  
  <p>I've set POST Referrer Filter for now to prevent arbitrary POST request 'outside' the website got accepted, however i can still get this response by typing jquery ajax request in the browser console while opening the website.
  I do wonder if this is bad or something, really new to Adobe CQ.</p>
  
  <p>The JQuery Script for testing it is actually only these:</p>
  
  <pre><code>$.ajax({
      url: 'http://www.example.com/content/fasfas',
      type: 'post',
      data: {},
      headers: {
          Accept: 'application/json',
      },
      dataType: 'json',
      success: function (data) {
          console.info(data);
      }
  });
  </code></pre>
  
  <p>Thanks in advance!</p>