you just cover them with a CSRF token embedded in page like ye olde days :)