0b3ada29_er_enabled_Cross_Site_Requests__Site_Communication_Mechanisms_Security_Considerations
[Description of Mechanism] Mutually agreed upon iframe and URL loading between sites, typically in sequential order. [Conforming User Agents] All Data is transferred 3 times before arriving at Mashup Site. See Mutual iframe Loading [Security Considerations] 
Cookies and Auth (private data) can be sent with requests, and user is unaware that such requests are taking place. Data Transferred as part of URI, which gets logged in proxies (easier leakage).
Browser-enabled Cross Site Requests
Security Considerations