Both Michal Zalewski[1] and Chris Evans[2] have commented on this, and I tend to agree with them. The actual implications for a CSRF like this are very minimal.<p>[1] <a href="https:&#x2F;&#x2F;lcamtuf.blogspot.com&#x2F;2010&#x2F;10&#x2F;http-cookies-or-how-not-to-design.html" rel="nofollow">https:&#x2F;&#x2F;lcamtuf.blogspot.com&#x2F;2010&#x2F;10&#x2F;http-cookies-or-how-not...</a>
[2] <a href="http:&#x2F;&#x2F;scarybeastsecurity.blogspot.com&#x2F;2010&#x2F;01&#x2F;logout-xsrf-significant-web-app-bug.html" rel="nofollow">http:&#x2F;&#x2F;scarybeastsecurity.blogspot.com&#x2F;2010&#x2F;01&#x2F;logout-xsrf-s...</a>