It's an easy-to-fix javascript bug that has been there for months.
I don't understand why they didn't fix it though. It makes the site feel insecure.