feat!: invoke actions on POST only

[wlatanowicz]

closes #16

[pfouque]

I like the idea of restricting to POST only, in order to avoid XSS. Is there any reason not to use <input type="hidden" name="{{ k }}" value="{{ v }}" /> (and a classic submit button)?

[wlatanowicz]

Is there any reason not to use <input type="hidden" name="{{ k }}" value="{{ v }}" /> (and a classic submit button)?

I decided to use <a> element as an action button, to avoid potentially complex changes to css styles.

[crccheck]

sorry for dragging my feet on this. I keep thinking I'll have time the next holiday to go over this, but real life keeps getting in the way. I like what I see so far; switching over to POST keeps things simple.

[SupraSummus]

@crccheck have you went over this PR? I'd really appreciate merging this in. Cheers!

[crccheck]

I think we need to phase in this feature more gradually. Like:

1. Add a toggle to use POST instead of GET (default to GET). Perhaps make the options: GET, POST, and ONLY_POST
2. Make a "breaking" change to the default from GET to POST

I've been meaning to do it for awhile but real life has gotten pretty busy