Their other illustration wasn't terribly useful either, though, request_token. That's supposed to change each time the form is generated and meanwhile this attack takes thousands of runs against the server...