Mail.ru: CSRF on draft message creation in tel.mail.ru

CSRF allowed to save message draft with attacker controlled content...