And why do browsers not let users go "I don't care about what this server's headers say, you will do as I say because I clicked the little checkbox that says I know better than you".
(On which note, no CSRF/CORS post is complete without talking about CSP, too)
(On which note, no CSRF/CORS post is complete without talking about CSP, too)