Comment by psychometry

I'm sure PayPal is using some form or CSRF protection to prevent a POST from some external site from working.