> The trick is to only allow logins from users that are carrying at least one cookie which you have set in that way—since you know that those cookies could not have been sent if the user originated in a form on another site.

It's crazy to me that HTTP servers need to rely on tricks like this to understand the context of a request.

At a minimum, it would be nice if `Origin` was sent with all requests from browsers, not just cross-origin XHR requests.