> why didnt you think about having this feature optional? Opt-in security features aren't very useful. > class based controllers are optional yet,because of t

> why didnt you think about having this feature optional? Opt-in security features aren't very useful. > class based controllers are optional yet,because of them you introduce a feature that affect function based controllers ? That's how competing constraints work out sometimes. We're always looking to improve though. The code is open source, so feel free to submit a PR or fork it if you disagree. :)