diff --git a/src/applications/phame/controller/blog/PhameBlogLiveController.php b/src/applications/phame/controller/blog/PhameBlogLiveController.php
index 40f0bfe3b..9b3e1fec8 100644
--- a/src/applications/phame/controller/blog/PhameBlogLiveController.php
+++ b/src/applications/phame/controller/blog/PhameBlogLiveController.php
@@ -1,56 +1,71 @@
 <?php
 
 /**
  * @group phame
  */
 final class PhameBlogLiveController extends PhameController {
 
   private $id;
   private $more;
 
   public function shouldAllowPublic() {
     return true;
   }
 
   public function willProcessRequest(array $data) {
     $this->id = idx($data, 'id');
     $this->more = idx($data, 'more', '');
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $user = $request->getUser();
 
     $blog = id(new PhameBlogQuery())
       ->setViewer($user)
       ->withIDs(array($this->id))
       ->executeOne();
     if (!$blog) {
       return new Aphront404Response();
     }
 
     if ($blog->getDomain() && ($request->getHost() != $blog->getDomain())) {
-      return id(new AphrontRedirectResponse())
-        ->setURI('http://'.$blog->getDomain().'/'.$this->more);
+      $base_uri = 'http://'.$blog->getDomain().'/';
+      if ($request->isFormPost()) {
+        return id(new AphrontRedirectResponse())
+          ->setURI($base_uri.$this->more);
+      } else {
+        // If we don't have CSRF, return a dialog instead of automatically
+        // redirecting, to prevent this endpoint from serving semi-open
+        // redirects.
+        $dialog = id(new AphrontDialogView())
+          ->setTitle(pht('Blog Moved'))
+          ->setUser($user)
+          ->appendChild(
+            pht('This blog is now hosted at %s.',
+              $base_uri))
+          ->addSubmitButton(pht('Continue'));
+        return id(new AphrontDialogResponse())->setDialog($dialog);
+      }
     }
 
     $phame_request = clone $request;
     $phame_request->setPath('/'.ltrim($this->more, '/'));
 
     if ($blog->getDomain()) {
       $uri = new PhutilURI('http://'.$blog->getDomain().'/');
     } else {
       $uri = '/phame/live/'.$blog->getID().'/';
       $uri = PhabricatorEnv::getURI($uri);
     }
 
     $skin = $blog->getSkinRenderer($phame_request);
     $skin
       ->setBlog($blog)
       ->setBaseURI((string)$uri);
 
     $skin->willProcessRequest(array());
     return $skin->processRequest();
   }
 
 }
diff --git a/src/applications/phame/controller/blog/PhameBlogViewController.php b/src/applications/phame/controller/blog/PhameBlogViewController.php
index 00214cf10..8accd39a1 100644
--- a/src/applications/phame/controller/blog/PhameBlogViewController.php
+++ b/src/applications/phame/controller/blog/PhameBlogViewController.php
@@ -1,159 +1,161 @@
 <?php
 
 /**
  * @group phame
  */
 final class PhameBlogViewController extends PhameController {
 
   private $id;
 
   public function willProcessRequest(array $data) {
     $this->id = $data['id'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $user = $request->getUser();
 
     $blog = id(new PhameBlogQuery())
       ->setViewer($user)
       ->withIDs(array($this->id))
       ->executeOne();
     if (!$blog) {
       return new Aphront404Response();
     }
 
     $pager = id(new AphrontCursorPagerView())
       ->readFromRequest($request);
 
     $posts = id(new PhamePostQuery())
       ->setViewer($user)
       ->withBlogPHIDs(array($blog->getPHID()))
       ->executeWithCursorPager($pager);
 
     $nav = $this->renderSideNavFilterView(null);
 
     $header = id(new PhabricatorHeaderView())
       ->setHeader($blog->getName());
 
     $handle_phids = array_merge(
       mpull($posts, 'getBloggerPHID'),
       mpull($posts, 'getBlogPHID'));
     $this->loadHandles($handle_phids);
 
     $actions = $this->renderActions($blog, $user);
     $properties = $this->renderProperties($blog, $user);
     $post_list = $this->renderPostList(
       $posts,
       $user,
       pht('This blog has no visible posts.'));
 
     $nav->appendChild(
       array(
         $header,
         $actions,
         $properties,
         $post_list,
       ));
 
     return $this->buildApplicationPage(
       $nav,
       array(
         'device'  => true,
         'title'   => $blog->getName(),
       ));
   }
 
   private function renderProperties(PhameBlog $blog, PhabricatorUser $user) {
     $properties = new PhabricatorPropertyListView();
 
     $properties->addProperty(
       pht('Skin'),
       $blog->getSkin());
 
     $properties->addProperty(
       pht('Domain'),
       $blog->getDomain());
 
     $descriptions = PhabricatorPolicyQuery::renderPolicyDescriptions(
       $user,
       $blog);
 
     $properties->addProperty(
       pht('Visible To'),
       $descriptions[PhabricatorPolicyCapability::CAN_VIEW]);
 
     $properties->addProperty(
       pht('Editable By'),
       $descriptions[PhabricatorPolicyCapability::CAN_EDIT]);
 
     $properties->addProperty(
       pht('Joinable By'),
       $descriptions[PhabricatorPolicyCapability::CAN_JOIN]);
 
     $engine = id(new PhabricatorMarkupEngine())
       ->setViewer($user)
       ->addObject($blog, PhameBlog::MARKUP_FIELD_DESCRIPTION)
       ->process();
 
     $properties->addTextContent(
       phutil_tag(
         'div',
         array(
           'class' => 'phabricator-remarkup',
         ),
         $engine->getOutput($blog, PhameBlog::MARKUP_FIELD_DESCRIPTION)));
 
     return $properties;
   }
 
   private function renderActions(PhameBlog $blog, PhabricatorUser $user) {
 
     $actions = id(new PhabricatorActionListView())
       ->setObject($blog)
       ->setUser($user);
 
     $can_edit = PhabricatorPolicyFilter::hasCapability(
       $user,
       $blog,
       PhabricatorPolicyCapability::CAN_EDIT);
 
     $can_join = PhabricatorPolicyFilter::hasCapability(
       $user,
       $blog,
       PhabricatorPolicyCapability::CAN_JOIN);
 
     $actions->addAction(
       id(new PhabricatorActionView())
         ->setIcon('new')
         ->setHref($this->getApplicationURI('post/edit/?blog='.$blog->getID()))
         ->setName(pht('Write Post'))
         ->setDisabled(!$can_join)
         ->setWorkflow(!$can_join));
 
     $actions->addAction(
       id(new PhabricatorActionView())
+        ->setUser($user)
         ->setIcon('world')
         ->setHref($this->getApplicationURI('live/'.$blog->getID().'/'))
+        ->setRenderAsForm(true)
         ->setName(pht('View Live')));
 
     $actions->addAction(
       id(new PhabricatorActionView())
         ->setIcon('edit')
         ->setHref($this->getApplicationURI('blog/edit/'.$blog->getID().'/'))
         ->setName('Edit Blog')
         ->setDisabled(!$can_edit)
         ->setWorkflow(!$can_edit));
 
     $actions->addAction(
       id(new PhabricatorActionView())
         ->setIcon('delete')
         ->setHref($this->getApplicationURI('blog/delete/'.$blog->getID().'/'))
         ->setName('Delete Blog')
         ->setDisabled(!$can_edit)
         ->setWorkflow(true));
 
     return $actions;
   }
 
 }
diff --git a/src/applications/phame/controller/post/PhamePostViewController.php b/src/applications/phame/controller/post/PhamePostViewController.php
index d29b582a0..d7edfeb17 100644
--- a/src/applications/phame/controller/post/PhamePostViewController.php
+++ b/src/applications/phame/controller/post/PhamePostViewController.php
@@ -1,196 +1,198 @@
 <?php
 
 /**
  * @group phame
  */
 final class PhamePostViewController extends PhameController {
 
   private $id;
 
   public function willProcessRequest(array $data) {
     $this->id = $data['id'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $user = $request->getUser();
 
     $post = id(new PhamePostQuery())
       ->setViewer($user)
       ->withIDs(array($this->id))
       ->executeOne();
 
     if (!$post) {
       return new Aphront404Response();
     }
 
     $nav = $this->renderSideNavFilterView();
 
     $nav->appendChild(
       id(new PhabricatorHeaderView())
         ->setHeader($post->getTitle()));
 
     if ($post->isDraft()) {
       $nav->appendChild(
         id(new AphrontErrorView())
           ->setSeverity(AphrontErrorView::SEVERITY_NOTICE)
           ->setTitle(pht('Draft Post'))
           ->appendChild(
             pht('Only you can see this draft until you publish it. '.
                 'Use "Preview / Publish" to publish this post.')));
     }
 
     if (!$post->getBlog()) {
       $nav->appendChild(
         id(new AphrontErrorView())
           ->setSeverity(AphrontErrorView::SEVERITY_WARNING)
           ->setTitle(pht('Not On A Blog'))
           ->appendChild(
             pht('This post is not associated with a blog (the blog may have '.
                 'been deleted). Use "Move Post" to move it to a new blog.')));
     }
 
     $this->loadHandles(
       array(
         $post->getBlogPHID(),
         $post->getBloggerPHID(),
       ));
 
     $actions = $this->renderActions($post, $user);
     $properties = $this->renderProperties($post, $user);
 
     $nav->appendChild(
       array(
         $actions,
         $properties,
       ));
 
     return $this->buildApplicationPage(
       $nav,
       array(
         'title'   => $post->getTitle(),
         'device'  => true,
       ));
   }
 
   private function renderActions(
     PhamePost $post,
     PhabricatorUser $user) {
 
     $actions = id(new PhabricatorActionListView())
       ->setObject($post)
       ->setUser($user);
 
     $can_edit = PhabricatorPolicyFilter::hasCapability(
       $user,
       $post,
       PhabricatorPolicyCapability::CAN_EDIT);
 
     $id = $post->getID();
 
     $actions->addAction(
       id(new PhabricatorActionView())
         ->setIcon('edit')
         ->setHref($this->getApplicationURI('post/edit/'.$id.'/'))
         ->setName('Edit Post')
         ->setDisabled(!$can_edit)
         ->setWorkflow(!$can_edit));
 
     $actions->addAction(
       id(new PhabricatorActionView())
         ->setIcon('move')
         ->setHref($this->getApplicationURI('post/move/'.$id.'/'))
         ->setName('Move Post')
         ->setDisabled(!$can_edit)
         ->setWorkflow(!$can_edit));
 
     if ($post->isDraft()) {
       $actions->addAction(
         id(new PhabricatorActionView())
           ->setIcon('preview')
           ->setHref($this->getApplicationURI('post/publish/'.$id.'/'))
           ->setName(pht('Preview / Publish')));
     } else {
       $actions->addAction(
         id(new PhabricatorActionView())
           ->setIcon('unpublish')
           ->setHref($this->getApplicationURI('post/unpublish/'.$id.'/'))
           ->setName(pht('Unpublish'))
           ->setWorkflow(true));
     }
 
     $actions->addAction(
       id(new PhabricatorActionView())
         ->setIcon('delete')
         ->setHref($this->getApplicationURI('post/delete/'.$id.'/'))
         ->setName('Delete Post')
         ->setDisabled(!$can_edit)
         ->setWorkflow(true));
 
     $blog = $post->getBlog();
     $can_view_live = $blog && !$post->isDraft();
 
     if ($can_view_live) {
       $live_uri = 'live/'.$blog->getID().'/post/'.$post->getPhameTitle();
     } else {
       $live_uri = 'post/notlive/'.$post->getID().'/';
     }
     $live_uri = $this->getApplicationURI($live_uri);
 
     $actions->addAction(
       id(new PhabricatorActionView())
+        ->setUser($user)
         ->setIcon('world')
         ->setHref($live_uri)
         ->setName(pht('View Live'))
+        ->setRenderAsForm(true)
         ->setDisabled(!$can_view_live)
         ->setWorkflow(!$can_view_live));
 
     return $actions;
   }
 
   private function renderProperties(
     PhamePost $post,
     PhabricatorUser $user) {
 
     $properties = new PhabricatorPropertyListView();
 
     $descriptions = PhabricatorPolicyQuery::renderPolicyDescriptions(
       $user,
       $post);
 
     $properties->addProperty(
       pht('Blog'),
       $post->getBlogPHID()
         ? $this->getHandle($post->getBlogPHID())->renderLink()
         : null);
 
     $properties->addProperty(
       pht('Blogger'),
       $this->getHandle($post->getBloggerPHID())->renderLink());
 
     $properties->addProperty(
       pht('Visible To'),
       $descriptions[PhabricatorPolicyCapability::CAN_VIEW]);
 
     $properties->addProperty(
       pht('Published'),
       $post->isDraft()
         ? pht('Draft')
         : phabricator_datetime($post->getDatePublished(), $user));
 
     $engine = id(new PhabricatorMarkupEngine())
       ->setViewer($user)
       ->addObject($post, PhamePost::MARKUP_FIELD_BODY)
       ->process();
 
     $properties->addTextContent(
       phutil_tag(
          'div',
         array(
           'class' => 'phabricator-remarkup',
         ),
         $engine->getOutput($post, PhamePost::MARKUP_FIELD_BODY)));
 
     return $properties;
   }
 }