GET requests don't get any CSRF protection by Rails,
thus these sensitive actions should be better protected.

Thanks to @tomekr for the report.