This looks like a PEBKAC issue.

I just tested again. Using application/json I can use:

  POST to create a new issue
  PUT to modify issue's title and status
  DELETE to retire an issue
  PATCH to retire and restore an issue
  POST with X-HTTP-METHOD-OVERRIDE DELETE to retire an issue

This is under uwsgi.

I did one fix. With PATCH and a json payload, the self.form.list was set to None. This caused a crash in csrf nonce checking. So the check now
validates that self.form.list is not None before it tries: '@csrf' in self.form.

If this passes CI, I will release a 2.0.0alpha0.