nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).
[R.352.5]
Identify especially dangerous operations. When the user performs a dangerous operation,
send a separate confirmation request to ensure that the user intended to perform that