GET would not be destroying your data and attacker.com won't see the response