Once again cool writeup! Thanks for the insights on the intended way. Do you know if someone used the intended way? 
I went with JS for the XSRF at first but I didn’t persevere through :lol:. In the end, I got in through the unintended way. Awesome write-up 
Of the people I’ve chatted with about it, I’d say it was about 20% went XSRF route.