title: Sending POST Request to Secured Action
body: <p>I have an action that takes POST data secured by sfGuard. This means that if the user is not logged in, the POST data will be sent to the log in form. Ordinarily, this is not a problem, the user continues to log in, and has to submit the data again.</p>
  
  <p>Unfortunately, the log in form seems to be using the POST data as if it was submitted with the form itself. This means that it is complaining that the required username and password fields are missing, and it complains that it is missing a CSRF token. This last problem does not go away, after submitting the form, meaning the user cannot log in, anyway.</p>
  
  <p>The user should not be presented with the form if not logged in, but it might be possible for the user to log out with the form still open. So I am asking in the interest of keeping the interface watertight and error-free.</p>
  
  <p>Is this a shortcoming of sfGuard, can it be avoided, or am I doing something wrong altogether?</p>
  
  <p>To clarify, the route looks like this:</p>
  
  <pre><code>add_subgroup:
    url:      /group/:id/add
    class:    sfPropelRoute
    options:
      model:  Group
      type:   object
    param:    { module: subgroups, action: create }
    requirements:
      group_id: \d+
      sf_method: [post]
  </code></pre>
  
  <p>The form used to submit the request is as follows:</p>
  
  <pre><code>&lt;form action="&lt;?php echo url_for('add_subgroup', $group) ?&gt;" method="post"&gt;
    &lt;input type="hidden" name="group_id" value="&lt;?php echo $group-&gt;getId() ?&gt;" /&gt;
    &lt;input type="text" name="subgroup_id" /&gt;
    &lt;input type="submit" class="button" value="Add" /&gt;
  &lt;/form&gt;
  </code></pre>