I'm pretty sure you should also use CSRF protection in POST requests when you do cookie-based sessions.