Merge pull request #7525 from cakephp/csrf-token

Unset CSRF token from request data after token validation.

This omits the csrf token in prg workflows.

src/Controller/Component/CsrfComponent.php

@@ -94,6 +94,7 @@ class CsrfComponent extends Component
         }
         if ($request->is(['patch', 'put', 'post', 'delete'])) {
             $this->_validateToken($request);
+            unset($request->data[$this->_config['field']]);
         }
     }
 

tests/TestCase/Controller/Component/CsrfComponentTest.php

@@ -156,6 +156,7 @@ class CsrfComponentTest extends TestCase
         $event = new Event('Controller.startup', $controller);
         $result = $this->component->startup($event);
         $this->assertNull($result, 'No exception means valid.');
+        $this->assertFalse(isset($controller->request->data['_csrfToken']));
     }
 
     /**