Tweet · 2 Apr 2015, 15:27 UTC

Replying to @cobyism

I’m pretty sure it is. You *could* make it work by checking that the request comes from a page, but it’s a bit dodgy.