Haha, I think I found your answer
NOTE: This is considered a URL hack and it is not supported by
Salesforce. Using undocumented query strings is absolutely discouraged
as Salesforce can change them at any time without notice. Instead this
requirement can be implemented by using the Force.com AJAX toolkit or
a Visualforce page with a custom controller.
Salesforce has implemented several features to prevent Cross-Site
Request Forgery (CSRF). As an example when a browser makes a request a
one-time token is attached to prevent CSRF attacks, however this also
prevents the use of the mentioned URL as clicking on it would generate
a GET request without the CSRF token.
Salesforce Support can disable the validation of the token on GET
requests, but this opens up the Salesforce application to CSRF
attacks. We strongly recommend that this feature remain enabled.
Customers can request this feature to be disabled though by raising a
case that contains the following statement/request:
"Please disable the validation of the CSRF token on GET requests. I
acknowledge I understand that my organisation may be potentially
exposed to CSRF attacks, and I will continue without the feature at my