Exercise 3: The csrf_token Gotcha — Possible Solution
====================================================================

WHAT HAPPENS IF {% csrf_token %} IS OMITTED
------------------------------
Django's own CSRF middleware rejects the form submission outright, returning a 403 Forbidden response, rather than processing the POST request at all. The view's own logic never even runs in this case - the request is blocked before it reaches add_item.

WHY THIS IS A REAL SECURITY FEATURE, NOT BOILERPLATE
------------------------------
CSRF (Cross-Site Request Forgery) protection exists to prevent a malicious site from tricking a logged-in user's browser into submitting a form to this application without the user's knowledge or consent. The csrf_token provides a value tied to the user's own session that only a legitimate form served by this application would include, letting Django's middleware distinguish a genuine submission from a forged one. This protection is automatically required for every POST form in Django, with no separate library or extra setup needed to enable it - it's part of the framework's own default behavior, exactly the kind of built-in protection this chapter frames as a genuine "batteries included" benefit rather than optional boilerplate that could reasonably be skipped.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly describes the 403 Forbidden rejection that results from a missing csrf_token, and correctly explains the real CSRF-protection purpose behind the requirement, framing it as legitimate, automatic security rather than an arbitrary or skippable formality.