forms: unified usage of h.secure_form. Make sure we ALWAYS pass in

request, and removed redundant 'POST' type.

rhodecode/templates/admin/defaults/defaults_repositories.mako

@@ -3,7 +3,7 b''
         <h3 class="panel-title">${_('Default Settings For New Repositories')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('admin_defaults_repositories_update'), method='POST', request=request)}
+        ${h.secure_form(h.route_path('admin_defaults_repositories_update'), request=request)}
         <div class="form">
             <!-- fields -->
 

rhodecode/templates/admin/gists/edit.mako

@@ -26,7 +26,7 b''
     <div class="table">
 
         <div id="files_data">
-          ${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', method='POST', request=request)}
+          ${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', request=request)}
             <div>
                 <input type="hidden" value="${c.file_last_commit.raw_id}" name="parent_hash">
                 <textarea id="description" name="description"

rhodecode/templates/admin/gists/new.mako

@@ -25,7 +25,7 b''
 
     <div class="table">
         <div id="files_data">
-          ${h.secure_form(h.route_path('gists_create'), id='eform', method='POST', request=request)}
+          ${h.secure_form(h.route_path('gists_create'), id='eform', request=request)}
             <div>
                 <textarea id="description" name="description" placeholder="${_('Gist description ...')}"></textarea>
 

rhodecode/templates/admin/gists/show.mako

@@ -45,7 +45,7 b''
                     <div class="stats">
                        %if h.HasPermissionAny('hg.admin')() or c.gist.gist_owner == c.rhodecode_user.user_id:
                         <div class="remove_gist">
-                            ${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), method='POST', request=request)}
+                            ${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), request=request)}
                                 ${h.submit('remove_gist', _('Delete'),class_="btn btn-mini btn-danger",onclick="return confirm('"+_('Confirm to delete this Gist')+"');")}
                             ${h.end_form()}
                         </div>

rhodecode/templates/admin/my_account/my_account_auth_tokens.mako

@@ -42,7 +42,7 b''
                      %endif
                 </td>
                 <td class="td-action">
-                    ${h.secure_form(h.route_path('my_account_auth_tokens_delete'), method='POST', request=request)}
+                    ${h.secure_form(h.route_path('my_account_auth_tokens_delete'), request=request)}
                         ${h.hidden('del_auth_token', auth_token.user_api_key_id)}
                         <button class="btn btn-link btn-danger" type="submit"
                                 onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.token_obfuscated}');">
@@ -59,7 +59,7 b''
     </div>
 
         <div class="user_auth_tokens">
-            ${h.secure_form(h.route_path('my_account_auth_tokens_add'), method='POST', request=request)}
+            ${h.secure_form(h.route_path('my_account_auth_tokens_add'), request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">

rhodecode/templates/admin/my_account/my_account_emails.mako

@@ -25,7 +25,7 b''
                         <span class="user email">${em.email}</span>
                     </td>
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('my_account_emails_delete'), method='POST', request=request)}
+                        ${h.secure_form(h.route_path('my_account_emails_delete'), request=request)}
                             ${h.hidden('del_email_id',em.email_id)}
                             <button class="btn btn-link btn-danger" type="submit" id="${'remove_email_%s'.format(em.email_id)}"
                                     onclick="return confirm('${_('Confirm to delete this email: {}').format(em.email)}');">
@@ -48,7 +48,7 b''
         </div>
 
         <div>
-            ${h.secure_form(h.route_path('my_account_emails_add'), method='POST', request=request)}
+            ${h.secure_form(h.route_path('my_account_emails_add'), request=request)}
             <div class="form">
                 <!-- fields -->
                 <div class="fields">

rhodecode/templates/admin/my_account/my_account_profile_edit.mako

@@ -6,7 +6,7 b''
     </div>
 
     <div class="panel-body">
-    ${h.secure_form(h.route_path('my_account_update'), class_='form', method='POST', request=request)}
+    ${h.secure_form(h.route_path('my_account_update'), class_='form', request=request)}
     <% readonly = None %>
     <% disabled = "" %>
 

rhodecode/templates/admin/my_account/my_account_ssh_keys.mako

@@ -24,7 +24,7 b''
                         <td class="td-tags">${h.format_date(ssh_key.created_on)}</td>
 
                         <td class="td-action">
-                            ${h.secure_form(h.route_path('my_account_ssh_keys_delete'), method='POST', request=request)}
+                            ${h.secure_form(h.route_path('my_account_ssh_keys_delete'), request=request)}
                                 ${h.hidden('del_ssh_key', ssh_key.ssh_key_id)}
                                 <button class="btn btn-link btn-danger" type="submit"
                                         onclick="return confirm('${_('Confirm to remove ssh key %s') % ssh_key.ssh_key_fingerprint}');">
@@ -43,7 +43,7 b''
 
         % if c.ssh_enabled:
         <div class="user_ssh_keys">
-            ${h.secure_form(h.route_path('my_account_ssh_keys_add'), method='POST', request=request)}
+            ${h.secure_form(h.route_path('my_account_ssh_keys_add'), request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">

rhodecode/templates/admin/permissions/permissions_application.mako

@@ -3,7 +3,7 b''
         <h3 class="panel-title">${_('System Wide Application Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('admin_permissions_application_update'), method='POST', request=request)}
+        ${h.secure_form(h.route_path('admin_permissions_application_update'), request=request)}
             <div class="form">
                 <!-- fields -->
                 <div class="fields">

rhodecode/templates/admin/permissions/permissions_global.mako

@@ -1,5 +1,5 b''
 
-${h.secure_form(h.route_path('admin_permissions_global_update'), method='POST', request=request)}
+${h.secure_form(h.route_path('admin_permissions_global_update'), request=request)}
     <div class="form permissions-global">
         <!-- fields -->
         <div class="fields">

rhodecode/templates/admin/permissions/permissions_ips.mako

@@ -23,7 +23,7 b''
               <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
               <td class="td-description"><div class="ip">${ip.description}</div></td>
               <td class="td-action">
-                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
+                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), request=request)}
                     ${h.hidden('del_ip_id',ip.ip_id)}
                     ${h.hidden('default_user', 'True')}
                     ${h.submit('remove_',_('Delete'),id="remove_ip_%s" % ip.ip_id,
@@ -43,7 +43,7 b''
       </table>
     </div>
 
-    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
+    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), request=request)}
       <div class="form">
         <!-- fields -->
         <div class="fields">

rhodecode/templates/admin/permissions/permissions_objects.mako

@@ -5,7 +5,7 b''
     <div class="panel-body">
         <p>${_('Default system permissions. Each permissions management entity will be created with the following default settings. Check the overwrite checkbox to force any permission changes on already existing settings.')}
         </p>
-        ${h.secure_form(h.route_path('admin_permissions_object_update'), method='POST', request=request)}
+        ${h.secure_form(h.route_path('admin_permissions_object_update'), request=request)}
             <div class="form">
                 <div class="fields">
                     <div class="field">

rhodecode/templates/admin/permissions/permissions_ssh_keys.mako

@@ -3,7 +3,7 b''
   <div class="panel-heading">
       <h3 class="panel-title">${_('SSH Keys')} - <span id="ssh_keys_count"></span></h3>
 
-      ${h.secure_form(h.route_path('admin_permissions_ssh_keys_update'), method='POST', request=request)}
+      ${h.secure_form(h.route_path('admin_permissions_ssh_keys_update'), request=request)}
         <button class="btn btn-link pull-right" type="submit">${_('Update SSH keys file')}</button>
       ${h.end_form()}
   </div>

rhodecode/templates/admin/repo_groups/repo_group_add.mako

@@ -27,7 +27,7 b''
         ${self.breadcrumbs()}
     </div>
     <!-- end box / title -->
-    ${h.secure_form(h.url('repo_groups'), method='post')}
+    ${h.secure_form(h.url('repo_groups'), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">

rhodecode/templates/admin/repo_groups/repo_group_edit_advanced.mako

@@ -28,7 +28,7 b''
         <h3 class="panel-title">${_('Delete repository group')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('delete_repo_group', group_name=c.repo_group.group_name),method='delete')}
+        ${h.secure_form(h.url('delete_repo_group', group_name=c.repo_group.group_name),method='delete', request=request)}
             <table class="display">
 
                 <tr>

rhodecode/templates/admin/repo_groups/repo_group_edit_perms.mako

@@ -5,7 +5,7 b''
         <h3 class="panel-title">${_('Repository Group Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('edit_repo_group_perms', group_name=c.repo_group.group_name),method='put')}
+        ${h.secure_form(h.url('edit_repo_group_perms', group_name=c.repo_group.group_name),method='put', request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>

rhodecode/templates/admin/repo_groups/repo_group_edit_settings.mako

@@ -6,7 +6,7 b''
         <h3 class="panel-title">${_('Settings for Repository Group: %s') % c.repo_group.name}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('update_repo_group',group_name=c.repo_group.group_name),method='put')}
+        ${h.secure_form(h.url('update_repo_group',group_name=c.repo_group.group_name),method='put', request=request)}
         <div class="form">
             <!-- fields -->
             <div class="fields">

rhodecode/templates/admin/repos/repo_add_base.mako

@@ -1,6 +1,6 b''
 ## -*- coding: utf-8 -*-
 
-${h.secure_form(h.route_path('repo_create'), method='POST', request=request)}
+${h.secure_form(h.route_path('repo_create'), request=request)}
 <div class="form">
     <!-- fields -->
     <div class="fields">

rhodecode/templates/admin/repos/repo_edit_advanced.mako

@@ -24,7 +24,7 b''
         <h3 class="panel-title">${_('Fork Reference')} <a class="permalink" href="#advanced-fork"> ¶</a></h3>
     </div>
     <div class="panel-body">
-      ${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+      ${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
 
         % if c.rhodecode_db_repo.fork:
             <div class="panel-body-title-text">${h.literal(_('This repository is a fork of %(repo_link)s') % {'repo_link': h.link_to_if(c.has_origin_repo_read_perm,c.rhodecode_db_repo.fork.repo_name, h.route_path('repo_summary', repo_name=c.rhodecode_db_repo.fork.repo_name))})}
@@ -48,7 +48,7 b''
         <h3 class="panel-title">${_('Public Journal Visibility')} <a class="permalink" href="#advanced-journal"> ¶</a></h3>
     </div>
     <div class="panel-body">
-      ${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+      ${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
         <div class="field">
         %if c.in_public_journal:
           <button class="btn btn-small" type="submit">
@@ -73,7 +73,7 b''
         <h3 class="panel-title">${_('Locking state')} <a class="permalink" href="#advanced-locking"> ¶</a></h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
 
         %if c.rhodecode_db_repo.locked[0]:
              <div class="panel-body-title-text">${'Locked by %s on %s. Lock reason: %s' % (h.person_by_id(c.rhodecode_db_repo.locked[0]),
@@ -113,7 +113,7 b''
         <h3 class="panel-title">${_('Delete repository')} <a class="permalink" href="#advanced-delete"> ¶</a></h3>
     </div>
     <div class="panel-body">
-      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), method='POST', request=request)}
+      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), request=request)}
         <table class="display">
             <tr>
                 <td>

rhodecode/templates/admin/repos/repo_edit_caches.mako

@@ -14,7 +14,7 b''
             </code>
         </p>
 
-        ${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), request=request)}
         <div class="form">
            <div class="fields">
                ${h.submit('reset_cache_%s' % c.rhodecode_db_repo.repo_name,_('Invalidate repository cache'),class_="btn btn-small",onclick="return confirm('"+_('Confirm to invalidate repository cache')+"');")}

rhodecode/templates/admin/repos/repo_edit_fields.mako

@@ -18,7 +18,7 b''
                     <td class="td-hash">${field.field_key}</td>
                     <td class="td-type">${field.field_type}</td>
                     <td class="td-action">
-                      ${h.secure_form(h.route_path('edit_repo_fields_delete', repo_name=c.rhodecode_db_repo.repo_name, field_id=field.repo_field_id), method='POST', request=request)}
+                      ${h.secure_form(h.route_path('edit_repo_fields_delete', repo_name=c.rhodecode_db_repo.repo_name, field_id=field.repo_field_id), request=request)}
                             ${h.hidden('del_repo_field',field.repo_field_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to delete this field: %s') % field.field_key}');">
@@ -31,7 +31,7 b''
               </table>
             </div>
             %endif
-            ${h.secure_form(h.route_path('edit_repo_fields_create', repo_name=c.repo_name), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_repo_fields_create', repo_name=c.repo_name), request=request)}
             <div class="form">
                 <!-- fields -->
                 <div class="fields">

rhodecode/templates/admin/repos/repo_edit_issuetracker.mako

@@ -1,7 +1,7 b''
 <%namespace name="its" file="/base/issue_tracker_settings.mako"/>
 
 <div id="repo_issue_tracker" class="${'inherited' if c.settings_model.inherit_global_settings else ''}">
-  ${h.secure_form(h.route_path('edit_repo_issuetracker_update', repo_name=c.repo_name), id="inherit-form", method='POST', request=request)}
+  ${h.secure_form(h.route_path('edit_repo_issuetracker_update', repo_name=c.repo_name), id="inherit-form", request=request)}
       <div class="panel panel-default panel-body">
           <div class="fields">
               <div class="field">

rhodecode/templates/admin/repos/repo_edit_permissions.mako

@@ -5,7 +5,7 b''
         <h3 class="panel-title">${_('Repository Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>

rhodecode/templates/admin/repos/repo_edit_remote.mako

@@ -19,7 +19,7 b''
                 </code>
             </p>
 
-            ${h.secure_form(h.route_path('edit_repo_remote_pull', repo_name=c.repo_name), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_repo_remote_pull', repo_name=c.repo_name), request=request)}
             <div class="form">
                <div class="fields">
                    ${h.submit('remote_pull_%s' % c.rhodecode_db_repo.repo_name,_('Pull changes from remote location'),class_="btn btn-small",onclick="return confirm('"+_('Confirm to pull changes from remote side')+"');")}

rhodecode/templates/admin/repos/repo_edit_settings.mako

@@ -6,7 +6,7 b''
         <h3 class="panel-title">${_('Settings for Repository: %s') % c.rhodecode_db_repo.repo_name}</h3>
     </div>
     <div class="panel-body">
-    ${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+    ${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">

rhodecode/templates/admin/repos/repo_edit_statistics.mako

@@ -3,7 +3,7 b''
         <h3 class="panel-title">${_('Repository statistics')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_repo_statistics_reset', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_repo_statistics_reset', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
         <div class="form">
             <div class="fields">
                <div class="field" >

rhodecode/templates/admin/repos/repo_edit_strip.mako

@@ -9,7 +9,7 b''
                 ${_('In the first step commits will be verified for existance in the repository')}. </br>
                 ${_('In the second step, correct commits will be available for stripping')}.
             </p>
-            ${h.secure_form(h.route_path('strip_check', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+            ${h.secure_form(h.route_path('strip_check', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
                 <div id="change_body" class="field">
                     <div id="box-1" class="inputx locked_input">
                         <input class="text" id="changeset_id-1" name="changeset_id-1" size="59"

rhodecode/templates/admin/repos/repo_edit_vcs.mako

@@ -1,7 +1,7 b''
 <%namespace name="vcss" file="/base/vcs_settings.mako"/>
 
 <div id="repo_vcs_settings" class="${'inherited' if c.inherit_global_settings else ''}">
-    ${h.secure_form(h.route_path('edit_repo_vcs_update', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+    ${h.secure_form(h.route_path('edit_repo_vcs_update', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
         <div class="form panel panel-default">
             <div class="fields panel-body">
                 <div class="field">

rhodecode/templates/admin/settings/settings_email.mako

@@ -34,7 +34,7 b''
         <h3 class="panel-title">${_('Test Email')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('admin_settings_email'), method='post')}
+        ${h.secure_form(h.url('admin_settings_email'), request=request)}
 
             <div class="field input">
                 ${h.text('test_email', size=60, placeholder=_('enter valid email'))}

rhodecode/templates/admin/settings/settings_global.mako

@@ -1,4 +1,4 b''
-${h.secure_form(h.url('admin_settings_global'), method='post')}
+${h.secure_form(h.url('admin_settings_global'), request=request)}
 
 <div class="panel panel-default">
     <div class="panel-heading" id="branding-options">

rhodecode/templates/admin/settings/settings_hooks.mako

@@ -28,7 +28,7 b''
     </div>
     <div class="panel-body">
         % if c.visual.allow_custom_hooks_settings:
-        ${h.secure_form(h.url('admin_settings_hooks'), method='post')}
+        ${h.secure_form(h.url('admin_settings_hooks'), request=request)}
         <div class="form">
             <div class="fields">
 

rhodecode/templates/admin/settings/settings_issuetracker.mako

@@ -5,7 +5,7 b''
         <h3 class="panel-title">${_('Issue Tracker / Wiki Patterns')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('admin_settings_issuetracker_save'), method='post')}
+        ${h.secure_form(h.url('admin_settings_issuetracker_save'), request=request)}
             ${its.issue_tracker_settings_table(
                 patterns=c.issuetracker_entries.items(),
                 form_url=h.url('admin_settings_issuetracker'),

rhodecode/templates/admin/settings/settings_labs.mako

@@ -3,7 +3,7 b''
         <h3 class="panel-title">${_('Labs Settings')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('admin_settings_labs'), method='post')}
+        ${h.secure_form(h.url('admin_settings_labs'), request=request)}
           <div class="form">
             <div class="fields">
               % if not c.lab_settings:

rhodecode/templates/admin/settings/settings_mapping.mako

@@ -1,4 +1,4 b''
-${h.secure_form(h.url('admin_settings_mapping'), method='post')}
+${h.secure_form(h.url('admin_settings_mapping'), request=request)}
 
 <div class="panel panel-default">
     <div class="panel-heading">

rhodecode/templates/admin/settings/settings_sessions.mako

@@ -28,7 +28,7 b''
         <h3 class="panel-title">${_('Cleanup Old Sessions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), method='POST', request=request)}
+        ${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), request=request)}
 
             <p>
             ${_('Cleanup user sessions that were not active during chosen time frame.')} <br/>

rhodecode/templates/admin/settings/settings_vcs.mako

@@ -1,6 +1,6 b''
 <%namespace name="vcss" file="/base/vcs_settings.mako"/>
 
-${h.secure_form(h.url('admin_settings_vcs'), method='post')}
+${h.secure_form(h.url('admin_settings_vcs'), request=request)}
     <div>
         ${vcss.vcs_settings_fields(
             suffix='',

rhodecode/templates/admin/settings/settings_visual.mako

@@ -1,4 +1,4 b''
-${h.secure_form(h.url('admin_settings_visual'), method='post')}
+${h.secure_form(h.url('admin_settings_visual'), request=request)}
 
 <div class="panel panel-default">
     <div class="panel-heading" id="general">

rhodecode/templates/admin/user_groups/user_group_add.mako

@@ -26,7 +26,7 b''
         ${self.breadcrumbs()}
     </div>
     <!-- end box / title -->
-    ${h.secure_form(h.route_path('user_groups_create'), method='POST', request=request)}
+    ${h.secure_form(h.route_path('user_groups_create'), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">

rhodecode/templates/admin/user_groups/user_group_edit_advanced.mako

@@ -44,7 +44,7 b''
         % endif
 
         <div>
-        ${h.secure_form(h.route_path('edit_user_group_advanced_sync', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_user_group_advanced_sync', user_group_id=c.user_group.users_group_id), request=request)}
             <div class="field">
                 <button class="btn btn-default" type="submit">
                     %if sync_type:
@@ -72,7 +72,7 b''
         <h3 class="panel-title">${_('Delete User Group')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('user_groups_delete', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
+        ${h.secure_form(h.route_path('user_groups_delete', user_group_id=c.user_group.users_group_id), request=request)}
             ${h.hidden('force', 1)}
             <button class="btn btn-small btn-danger" type="submit"
                     onclick="return confirm('${_('Confirm to delete user group `%(ugroup)s` with all permission assignments') % {'ugroup': c.user_group.users_group_name}}');">

rhodecode/templates/admin/user_groups/user_group_edit_perms.mako

@@ -5,7 +5,7 b''
         <h3 class="panel-title">${_('User Group Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_user_group_perms_update', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_user_group_perms_update', user_group_id=c.user_group.users_group_id), request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>

rhodecode/templates/admin/user_groups/user_group_edit_settings.mako

@@ -6,7 +6,7 b''
         <h3 class="panel-title">${_('User Group: %s') % c.user_group.users_group_name}</h3>
     </div>
     <div class="panel-body">
-    ${h.secure_form(h.route_path('user_groups_update', user_group_id=c.user_group.users_group_id), id='edit_user_group', method='POST', request=request)}
+    ${h.secure_form(h.route_path('user_groups_update', user_group_id=c.user_group.users_group_id), id='edit_user_group', request=request)}
         <div class="form">
             <!-- fields -->
                 <div class="fields">

rhodecode/templates/admin/users/user_edit_auth_tokens.mako

@@ -38,7 +38,7 b''
                          %endif
                     </td>
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), method='POST', request=request)}
+                        ${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), request=request)}
                             ${h.hidden('del_auth_token', auth_token.user_api_key_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.token_obfuscated}');">
@@ -55,7 +55,7 b''
         </div>
 
         <div class="user_auth_tokens">
-            ${h.secure_form(h.route_path('edit_user_auth_tokens_add', user_id=c.user.user_id), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_user_auth_tokens_add', user_id=c.user.user_id), request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">

rhodecode/templates/admin/users/user_edit_emails.mako

@@ -24,7 +24,7 b''
                         <span class="user email">${em.email}</span>
                     </td>
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), method='POST', request=request)}
+                        ${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), request=request)}
                             ${h.hidden('del_email_id', em.email_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to delete this email: %s') % em.email}');">
@@ -46,7 +46,7 b''
           </table>
         </div>
 
-        ${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), request=request)}
         <div class="form">
             <!-- fields -->
             <div class="fields">

rhodecode/templates/admin/users/user_edit_groups.mako

@@ -19,7 +19,7 b''
         </div>
 
         <div class="groups_management">
-            ${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), request=request)}
             <div id="repos_list_wrap">
                 <table id="user_group_list_table" class="display"></table>
             </div>

rhodecode/templates/admin/users/user_edit_ips.mako

@@ -30,7 +30,7 b''
             <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
             <td class="td-description"><div class="ip">${ip.description}</div></td>
             <td class="td-action">
-                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
+                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), request=request)}
                     ${h.hidden('del_ip_id', ip.ip_id)}
                     ${h.submit('remove_', _('Delete'),id="remove_ip_%s" % ip.ip_id,
                     class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this ip: %s') % ip.ip_addr+"');")}
@@ -51,7 +51,7 b''
 </div>
 
         <div>
-    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
+    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">

rhodecode/templates/admin/users/user_edit_ssh_keys.mako

@@ -21,7 +21,7 b''
                     <td class="td-tags">${h.format_date(ssh_key.created_on)}</td>
 
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('edit_user_ssh_keys_delete', user_id=c.user.user_id), method='POST', request=request)}
+                        ${h.secure_form(h.route_path('edit_user_ssh_keys_delete', user_id=c.user.user_id), request=request)}
                             ${h.hidden('del_ssh_key', ssh_key.ssh_key_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to remove ssh key %s') % ssh_key.ssh_key_fingerprint}');">
@@ -38,7 +38,7 b''
         </div>
 
         <div class="user_ssh_keys">
-            ${h.secure_form(h.route_path('edit_user_ssh_keys_add', user_id=c.user.user_id), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_user_ssh_keys_add', user_id=c.user.user_id), request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">

rhodecode/templates/base/default_perms_box.mako

@@ -94,7 +94,7 b''
 </%def>
 
 <%def name="default_perms_box(form_url)">
-  ${h.secure_form(form_url, method='POST', request=request)}
+  ${h.secure_form(form_url, request=request)}
     <div class="form">
       <div class="fields">
         <div class="field panel panel-default panel-body">

rhodecode/templates/data_table/_dt_elements.mako

@@ -167,7 +167,7 b''
         <i class="icon-pencil"></i>Edit</a>
     </div>
     <div class="grid_delete">
-      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), method='POST', request=request)}
+      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), request=request)}
         ${h.submit('remove_%s' % repo_name,_('Delete'),class_="btn btn-link btn-danger",
         onclick="return confirm('"+_('Confirm to delete this repository: %s') % repo_name+"');")}
       ${h.end_form()}
@@ -240,7 +240,7 b''
     <a href="${h.url('edit_repo_group',group_name=repo_group_name)}" title="${_('Edit')}">Edit</a>
  </div>
  <div class="grid_delete">
-    ${h.secure_form(h.url('delete_repo_group', group_name=repo_group_name),method='delete')}
+    ${h.secure_form(h.url('delete_repo_group', group_name=repo_group_name),method='delete', request=request)}
         ${h.submit('remove_%s' % repo_group_name,_('Delete'),class_="btn btn-link btn-danger",
         onclick="return confirm('"+_ungettext('Confirm to delete this group: %s with %s repository','Confirm to delete this group: %s with %s repositories',gr_count) % (repo_group_name, gr_count)+"');")}
     ${h.end_form()}
@@ -266,7 +266,7 b''
     <a href="${h.route_path('edit_user_group', user_group_id=user_group_id)}" title="${_('Edit')}">Edit</a>
  </div>
  <div class="grid_delete">
-    ${h.secure_form(h.route_path('user_groups_delete', user_group_id=user_group_id), method='POST', request=request)}
+    ${h.secure_form(h.route_path('user_groups_delete', user_group_id=user_group_id), request=request)}
       ${h.submit('remove_',_('Delete'),id="remove_group_%s" % user_group_id, class_="btn btn-link btn-danger",
       onclick="return confirm('"+_('Confirm to delete this user group: %s') % user_group_name+"');")}
     ${h.end_form()}

rhodecode/templates/files/files_add.mako

@@ -27,7 +27,7 b''
     <div class="edit-file-title">
         ${self.breadcrumbs()}
     </div>
-    ${h.secure_form(h.route_path('repo_files_create_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', method='POST', enctype="multipart/form-data", class_="form-horizontal", request=request)}
+    ${h.secure_form(h.route_path('repo_files_create_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', enctype="multipart/form-data", class_="form-horizontal", request=request)}
     <div class="edit-file-fieldset">
         <div class="fieldset">
             <div id="destination-label" class="left-label">

rhodecode/templates/files/files_delete.mako

@@ -27,7 +27,7 b''
     <div class="edit-file-title">
         ${self.breadcrumbs()}
     </div>
-    ${h.secure_form(h.route_path('repo_files_delete_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', method='POST', class_="form-horizontal", request=request)}
+    ${h.secure_form(h.route_path('repo_files_delete_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', class_="form-horizontal", request=request)}
     <div class="edit-file-fieldset">
         <div class="fieldset">
             <div id="destination-label" class="left-label">

rhodecode/templates/files/files_edit.mako

@@ -42,7 +42,7 b''
     </div>
 
     <div class="table">
-        ${h.secure_form(h.route_path('repo_files_update_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', method='POST', request=request)}
+        ${h.secure_form(h.route_path('repo_files_update_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', request=request)}
         <div id="codeblock" class="codeblock" >
         <div class="code-header">
             <div class="stats">

rhodecode/templates/forks/fork.mako

@@ -27,7 +27,7 b''
           ${self.breadcrumbs()}
       </div>
 
-    ${h.secure_form(h.route_path('repo_fork_create',repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+    ${h.secure_form(h.route_path('repo_fork_create',repo_name=c.rhodecode_db_repo.repo_name), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">

rhodecode/templates/pullrequests/pullrequest.mako

@@ -22,7 +22,7 b''
         ${self.repo_page_title(c.rhodecode_db_repo)}
     </div>
 
-    ${h.secure_form(h.route_path('pullrequest_create', repo_name=c.repo_name, _query=request.GET.mixed()), id='pull_request_form', method='POST', request=request)}
+    ${h.secure_form(h.route_path('pullrequest_create', repo_name=c.repo_name, _query=request.GET.mixed()), id='pull_request_form', request=request)}
 
         ${self.breadcrumbs()}
 

rhodecode/templates/pullrequests/pullrequest_merge_checks.mako

@@ -47,7 +47,7 b''
           % endif
 
         <div>
-          ${h.secure_form(h.route_path('pullrequest_merge', repo_name=c.repo_name, pull_request_id=c.pull_request.pull_request_id), id='merge_pull_request_form', method='POST', request=request)}
+          ${h.secure_form(h.route_path('pullrequest_merge', repo_name=c.repo_name, pull_request_id=c.pull_request.pull_request_id), id='merge_pull_request_form', request=request)}
           <% merge_disabled = ' disabled' if c.pr_merge_possible is False else '' %>
           <a class="btn" href="#" onclick="refreshMergeChecks(); return false;">${_('refresh checks')}</a>
           <input type="submit" id="merge_pull_request" value="${_('Merge Pull Request')}" class="btn${merge_disabled}"${merge_disabled}>

rhodecode/templates/pullrequests/pullrequest_show.mako

@@ -52,7 +52,7 b''
             %if c.allowed_to_update:
               <div id="delete_pullrequest" class="pull-right action_button ${'' if c.allowed_to_delete else 'disabled' }" style="clear:inherit;padding: 0">
                   % if c.allowed_to_delete:
-                      ${h.secure_form(h.route_path('pullrequest_delete', repo_name=c.pull_request.target_repo.repo_name, pull_request_id=c.pull_request.pull_request_id), method='POST', request=request)}
+                      ${h.secure_form(h.route_path('pullrequest_delete', repo_name=c.pull_request.target_repo.repo_name, pull_request_id=c.pull_request.pull_request_id), request=request)}
                           ${h.submit('remove_%s' % c.pull_request.pull_request_id, _('Delete'),
                         class_="btn btn-link btn-danger no-margin",onclick="return confirm('"+_('Confirm to delete this pull request')+"');")}
                       ${h.end_form()}