"I don't understand the connection between CSRF and what the site superadmin is doing. " <- More security education needed for developers