title: how to block anyone from requesting a url and with another user's cookie
body: <p>So I made a twitter clone but I discovered that anyone can just request a URL like this:</p>
  <pre><code>import requests
  requets.post(&quot;/follow-user_u={target_user}&quot;, cookie={&quot;username&quot;: &quot;username&quot;})
  </code></pre>
  <p>and make it so anyone can follow them if they change the cookie to another user's username</p>
  <p>So how do I protect against this ?
  I'm using flask</p>