CSRF vulnerability on blacklist removal

The admin/settings/page_syndication/referer_blacklist/remove/%-path should be protected against CSRF attacks by using a token or confirmation form. Otherwise authorized users can be tricked into unknowingly removing blacklisted referrers.

$items['admin/settings/page_syndication/referer_blacklist/remove/%'] = array(
  'page callback' => 'remove_referer',
  'page arguments' => array(5),
  'access arguments' => array('administer site configuration'),
  'file' => 'page_syndication.admin.inc'
); 

function remove_referer($id) {
  db_query('DELETE FROM {page_syndication_referer_blacklist} WHERE id=%d', $id);
  
  drupal_goto('admin/settings/page_syndication/referer_blacklist');
}