Cross site request forgery (csrf)

Request to LDAP is sent before user permissions are checked...