Storing previous URL as session data

[eluser]Jelmer[/eluser]
As we basicly agree this discussion is getting a bit useless. This'll be the last time I write a quick&dirty;example for something this complex

The point I was trying to make is that it doesn't make a significant difference in security if you implement it using POST or GET. What matters is how you implement your tokens, implementing them as a nonce is of course the prefered way to go.
What I took issue with in your last post was that it looked like the POST part was the most important point of the difference in the sentense you quoted, but the most important difference was the nonce. When comparing post with a nonce and get with a nonce there's no significant security diffence, only differnce is in style & best practice.