Account takeover via cookie-authorized cross-site requests

CSRF in rAthena FluxCP before e3f130c allows remote attackers to take over accounts by inducing authenticated users to submit requests. Account-module POST handlers for email, password, and credit transfers authorize state changes solely with the session cookie, without per-request tokens or Origin checks. Exploitation requires a logged-in user to visit attacker-controlled content; the resulting request can change credentials, redirect email confirmation, or transfer in-site assets.