A bаnking API expоses а POST /trаnsfer endpоint that reads the sessiоn cookie to identify the user and transfer funds. The team already stores passwords with bcrypt and validates all inputs. During review, someone visits an attacker-controlled page while logged in to the bank in another tab; that page auto-submits a hidden form to /transfer, and the transfer succeeds. Which control most directly addresses THIS failure, and why? Select the ONE best answer.