What do you mean with clientside Javascript CSRF?