That's exactly why I don't agree that GETs should be broadly exempted from CSRF protections. I'm not talking about CORS at all.