CSRF protection should be implemented even if your entire site is protected by SSL.
Also, I didn't say "just as dangerous", I said "just dangerous"
Also, I didn't say "just as dangerous", I said "just dangerous"
However, with proper CSRF protection your man in the middle argument is not the case is it?