CSRF, and the cookie flag

<form action="https://bank.com/transfer" method="POST"> <input name="to"...