Security section in forms tutorial

[MichaelClerx]

Hi all, thanks for some great tutorials!

Wondering about the "security" section in the django_forms tutorial. At the moment it teaches you to hide the buttons and worry about the rest later (in an extension tutorial). Isn't that setting a very bad example for dealing with security?

[inventhouse]

I noticed this as well and cringed. I included the following at the top of my new and edit views:

from django.core.exceptions import PermissionDenied
...
def new_post(request):
    if not request.user.is_authenticated():
        raise PermissionDenied("No logged in user")

[jhodgdon-drp]

I was also cringing. How about making a PR that would:

• Explain a bit more about security (how hiding buttons is just "security by obscurity", which isn't real security)
• Adds the suggestion by @inventhouse