`Request.Form` includes values from the query string, which creates a big CSRF hole in this feature. You can remove these two lines and use `PostFormValue("_method")` below to only read from the body.