Found the relevant code:
var c=this.jDiv.find(".comment-form");
c.find(".discussion-info").length ||
($("<div style='margin:12px 0 3px; font-weight:bold' class='discussion-info'>Please avoid extended discussions in comments. Would you like to <a href='#'>automatically move this discussion to chat?</a></div>")
.find("a").click(function(a){
$(this).unbind("click");
a.preventDefault();
b.ajax({url:"/posts/"+b.postId+"/move-discussion-to-chat", data:{fkey:StackExchange.options.user.fkey},type:"POST"},"when trying to move the discussion to chat",c).done(function(a){a.success?window.location.href=a.message:StackExchange.helpers.showErrorPopup(c,a.message)})}).end().prependTo(c),a.remove())}}});
So, we can see that it is doing a POST to /posts/{postId}/move-discussion-to-chat
and StackExchange.options.user.fkey
is passed along; this would require an user script to replicate. Simply because you can only make GET requests through your address bar...
Here are observations when reproducing this:
It does not work on Meta.SU, simply because there is no chat for Meta.SU.
This does not work on posts you are not involved in, luckily...
Refiring this on my posts does not seem to work, the conditions are effectively checked.
HTTP/1.1 404 Not Found
Cache-Control: private
Content-Type: application/json
Set-Cookie: usr=t=$$$$&s=$$$$; domain=.superuser.com; expires=$$$$; path=/; HttpOnly
Date: $$$$
Content-Length: 0
Note that I filtered away personal information with $$$$
.
Alternatively, it could use cookies to check whether the requests have not been tampered with. Seems the Stack Exchange developers do their job well, for a good reason...
@User1: let's move this conversation to http://chat.stackexchange.com/room-for-you-and-me
or something to that effect.