Sorry for misquoting you.

However, with proper CSRF protection your man in the middle argument is not the case is it?