Most of the REST resources in the Navigator plugin accept "x-www-form-urlencoded" bodies but do not check for an XSRF token when making mutative changes. For example:

• SaveFilterResource: Allow XSRF attack to change user's filter.
• SuppressedTipsResource
• UserSearchModeResource
• PreferredSearchLayoutResource
• IssueTableResource: Allow XSRF attack to change the user's current search.
  *...