Completely misses the point of XSS and XSRF attacks. In those scenarios the 'attacking' browser is actually the attacker's victim. If you use this module, an attacker can link a victim to you and have your 'defences' arbitrarily attack them, making you part of the problem, not the solution.