I think modern browsers prevent cross-requests to local subnets so this may mitigate CSRF