CSRF/XSRF protection different approach, is it safe?

[eluser]Jelmer[/eluser]
I've been thinking and doing some Google searches, the biggest danger should come from Flash & Java. Would it be possible for a Flash or Java program running on another site to use my session on my own site and fake the headers before doing so? I'd think those types of applications wouldn't have access to off-site cookies when doing requests but I'm not entirely sure...

tomcode, I know but I have the URL helper autoloaded in all my applications so I'm just used to site_url(). I only loaded the helper here to show it's used in the example.