CSRF only on POST request, reason?

I'd be interested in responses to these questions as well. Incidentally, is there a way to subscribe to a thread without having to reply to it?

My personal take on 1. is that CI was reasonably confident that it could add CSRF protection to forms without too much risk of breaking everything since using form_open() automatically creates the hidden input field for the token. Even then, it looks like the forum still receives questions about POST requests failing which oftentimes turns out to be due to CSRF protection. On the other hand, there are no established CI mechanisms for PUT or DELETE requests since CI probably did not have these in mind in its earlier incarnations and would have an increased risk of breaking these requests for applications already using them. That said, this is all just conjecture on my part. For any RESTful requests, I just add the token in myself.