>But you have all the code and you know which functions/methods/etc that can do requests so it should be trivial

but you can't. See the last part of my comment: "they can inject arbitrary scripts into pages to make requests for them".

>either way, if it is not a solvable problem, there is a major problem in the design.

Not really. It's like complaining that debuggers can impersonate programs they attach themselves to.