diff --git a/admin_hover.module b/admin_hover.module
index f3952ce..9042062 100755
--- a/admin_hover.module
+++ b/admin_hover.module
@@ -170,6 +170,9 @@ function admin_hover_node_action($nid, $action) {
     'make_unsticky' => 'make_sticky',
   );
   if (is_numeric($nid) && isset($undo[$action])) {
+    if (!isset($_GET['token']) || !drupal_valid_token('node/' . $nid . '/admin_hover/' . $action)) {
+      drupal_access_denied();
+    }
     $node = node_load($nid);
     $function = 'node_'. $action .'_action';
     $function($node);
@@ -641,11 +644,19 @@ function admin_hover_links($admin_hover, $object, $id, $destination, $check_acce
     $link['title arguments'] = array($link['title'], $link['title arguments']);
     $link['attributes']['title'] = call_user_func_array($link['title callback'], $link['title arguments']);
     $link['destination'] = isset($link['destination']) ? $link['destination'] : TRUE;
+    $query_fragment = array();
+    if (strpos($link['href'], '/admin_hover/') !== FALSE) {
+      $query_fragment['token'] = drupal_get_token($link['href']);
+    }
+    if ($link['destination']) {
+      list($key, $val) = explode('=', $destination);
+      $query_fragment['destination'] = $val;
+    }
     $admin_hover_links[] = array(
       'title' => '',
       'href' => $link['href'],
       'attributes' => $link['attributes'],
-      'query' => ($link['destination'] ? $destination : NULL),
+      'query' => $query_fragment,
     );
   }
   return $admin_hover_links;