Unauthorized access – direct tab clone or reload without POST.