Add support for special _method field to overwrite POST for routing

[thekid]

HTML forms do not support anything other than GET and POST. The value sent with the _method field will be used as the HTTP request method instead of POST:

<form action="/example" method="POST">
  <input type="hidden" name="_method" value="PUT">
  <!-- Rest of form -->
</form>

This will use PUT for the server-side routing instead of POST. The method inside the request object will stay the same, though.

The name was chosen as it is a pseudo-standard amongst various frameworks.

---

See also:

• https://laravel.com/docs/10.x/routing#form-method-spoofing
• https://codeigniter.com/user_guide/incoming/methodspoofing.html
• https://coldbox.ortusbooks.com/the-basics/routing/http-method-spoofing
• https://docs.adonisjs.com/guides/request#form-method-spoofing
• https://www.alexedwards.net/blog/http-method-spoofing
• GHSA-j4mm-7pj3-jf7v

[thekid]

Released in https://github.com/xp-forge/frontend/releases/tag/v5.4.0