Fixed: vars allowed in :href, but not :action
Added: spec to check for vars in form :action