Adobe security researcher Peleus Uhley reported that when plugin-initiated
requests receive a 307 redirect response, the plugin is not notified and
the request is forwarded to the new location. This is true even for
cross-site redirects, so any custom headers that were added as part of the
initial request would be forwarded intact across origins. This poses a CSRF
risk for web applications that rely on custom headers only being present in
requests from their own origin.