* add CSRF token as core.csrf_token * add CSRF tokens to client-generated and/or JS-submitted forms * remove broken "compatibility" mode of web.ajax.post /cc @dmo-odoo I've no idea how that was supposed to work, from looking things up all modern browsers seem to support FormData, and old IEs which don't don't support fallbacks either and would require submitting an actual form as fallback so...