To avoid replay attacks, use my "one click" processing technique. That'll also verify that it was a fresh form submission, and not forged from somewhere else.