symfony/symfony — pull request #11648 by hubgit (2014-08-11 14:12:23+00:00)
Title: Remove CSRF warning from enableHttpMethodParameterOverride documentation

Unless there's a good reason to keep it (nothing was forthcoming when [I asked on the user list](https://groups.google.com/forum/#!topic/Symfony2/88nn3y_Wi3w)), this documentation is misleading.

As far as I can tell, the `_method` parameter can only turn a `POST` request into `PUT` or `DELETE` request, which shouldn't have an effect on CSRF token validation.

If there is actually a security issue when `httpMethodParameterOverride` is enabled, that should be documented so that users know how to avoid it.