Originally Posted by [FMJ]PowerSurge

I do have money to buy a domain, actually; we've had to migrate hosts twice because of bandwidth usage so we're not buying a set domain until we know we're staying.

And yes, it is insecure, but until I find a way to whitelist an IP as a POST referrer, it's going to have to be insecure.
As long as it's not made blatantly clear that there's no protection against POST data, people aren't going to try to send POST requests.

That's like me putting in random credit card numbers. It can work in my favour, but it's not very likely unless someone gives the details out.