This long comment boils down to "so this is an attack that negates the protection that TLS gives you in defending against CSRF attacks". Yes, in the CSRF case, that's what the attack is.