Exercise 2: What Happens Without {% csrf_token %} — Possible Solution
====================================================================

WHAT HAPPENS
------------------------------
Per this chapter, leaving {% csrf_token %} out of a form means the submission is rejected outright - a 403 Forbidden response, every single time, with no exceptions.

WHY THIS HAPPENS EVEN THOUGH THE FORM LOOKS CORRECT
------------------------------
Per this chapter, Django protects every POST request with CSRF verification by default, at the framework level, completely independent of whether any particular template author remembered to include a token. The form's HTML can be entirely well-formed, submit to the right URL, use the right method, and still fail - because {% csrf_token %} renders a specific hidden input field that Django's own CSRF middleware checks for on every incoming POST, and without that field physically present in the submitted form data, the middleware has nothing to verify and rejects the request before it ever reaches the view's own logic.

WHY THIS IS A COMMON CONFUSION FOR NEWCOMERS
------------------------------
Per this chapter, this is one of the most common "why won't my form submit" confusions for anyone new to Django specifically because the form can look completely correct by every visual and structural measure, and still fail for a reason that has nothing to do with the form's own visible markup - the missing piece is a single hidden field whose absence isn't obvious just by looking at the rendered page.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly states that the result is a guaranteed 403 rejection, and correctly explains the mechanism (Django's CSRF middleware checking for a hidden field that csrf_token renders) rather than just asserting that CSRF protection exists.