Seriously? Seems like a security problem waiting to happen... gotta give this a try now.
Also, sure, every webserver could proxy the requests—but then you have to guarantee that you haven't created an open proxy, which is a much worse hole than a simple CSRF—and then you have to do some more server-side configuration every time you want to enable your views to touch a new third-party API—which excludes a lot of hosted sites, like blogs, from using any API that their server admin hasn't considered.