[btford]

> shoved at the latest minute

The pull request was opened 3 weeks ago with plenty of discussion.

[thatthatis]

3 weeks of discussion for a breaking change is "last minute" in my book

[camus2]

why didnt you think about having this feature optional? class based controllers are optional yet,because of them you introduce a feature that affect function based controllers ?

[btford]

> why didnt you think about having this feature optional?

Opt-in security features aren't very useful.

> class based controllers are optional yet,because of them you introduce a feature that affect function based controllers ?

That's how competing constraints work out sometimes.

We're always looking to improve though. The code is open source, so feel free to submit a PR or fork it if you disagree. :)