cakephp/cakephp — pull request #2285 by markstory (2013-11-08 18:45:43+00:00)
Title: 3.0 CSRF component

Implement the cookie based CSRF tokens described in #2214. Also remove the csrf features from SecurityComponent. I think this new solution is much much simpler than the old one, easier to read/comprehend and easier to work with. While the FormHelper tests do not currently run, I did some manual testing to verify that the CSRF component and FormHelper play nice together.

A few questions I had were:

* Should the SecurityComponent add the CsrfComponent as well?
* Should we allow HttpOnly, or Secure only CSRF tokens?