cross-site request forgery

How CSRF attacks work