- install flask-wtf
- app.config['SECRET_KEY'] for each application to prevent CSRF
- WTF
	- inherit from flask.ext.wtf.Form
	- from wtforms import StringField... ***Field
	- from wtforms.validator import Required ...
- Work with templates
	- form.name.lable
	- form.name()
	- form.submit()
- Model
	- form.validate_on_submit()
- Post/Redirect/Get Pattern
	- Re-Post cause duplication submission, so when receive post, redirect user to get and use session to have state of user submission
- flash
	- Give user instance response
	- in view, flash(...)
	- in template, {% for message in get_flashed_messages() %}