ButtonTo() doesn't support CSRF

[neokoenig]

As buttonTo() creates a form, it should automatically include appropriate CSRF tokens if required?

 #buttonTo(
  text="Delete",
  route="myRoute",
  key=id,
  method="delete",
  encode="attributes"                  
 )#

Results in

<form action="/admin/roles/3" method="post">
  <input id="_method" name="_method" type="hidden" value="delete">
  <input class="btn btn-primary" type="submit" value="Delete">
</form>

Without the CSRF token

[chapmandu]

I'm wondering if the startFormTag() could be used here rather than this element helper..

cfwheels/wheels/view/links.cfm

Line 147 in 15b4d91

return $element(name="form", skip=local.skip, content=local.content, attributes=arguments, encode=local.encode, encodeExcept=local.encodeExcept);

[perdjurner]

Using startFormTag would be a good approach for later but for additional beta releases like this one we should minimize any possibility of adding more bugs. Best way to do that is to just add in the authenticityTokenField() call to buttonTo I think, even if it creates some ugly / duplicate code for now.