In the WorkflowDesigner the side-effect operations are done by sending HTTP GET requests. Such requests require to have the session token to be specified in order to protect any CRSF attempts. But, in the case of removal, the request is performed directly by an explicit relocation (document.location) instead of using a simple anchor. In this situation, there is no session token set automatically. And, if the URL to which the relocation is performed contains some specific keywords (like creat for example), then the massive web shield forbiddes such relocation attempt without any anti-CRSF token. So, the fix was to replace the relocation mechanism by one in which a form is dynamically generated for the removal with as HTTP method POST.
By the way, I discovered by testing the fix the workflow designer wasn't designer to create a workflow from scratch but to edit existing ones. Besides that, I discovered also some hidden bugs. So I took the opportunity to clean up this mess up to a given level (in order to avoid to rewrite all the designer or to take too much time in this effort).
