One thing I clearly didn't appreciate when reading the instructions to upgrade to version 1.6.0 was that the following CSRF hidden fields should be added to all the forms:

<input name="@csrf" type="hidden"
           tal:attributes="value python:utils.anti_csrf_nonce()">

This was the other major change a performed on the HTML.

If it is necessary to update all forms with this field, perhaps the upgrade document could be made more explicit with this instruction?

Kind regards

Matt...