Cover the integration boundary for CSRF-style hidden fields: InteractionForm keeps arbitrary form fields available to app/auth extractors instead of dropping them during dispatch parsing. req: auth/004