Exercise 3: Two Mechanisms Behind Automatic CSRF Protection — Possible Solution
====================================================================

THE TWO MECHANISMS
------------------------------
Per this chapter, ApplicationController includes protect_from_forgery with: :exception by default, which rejects any state-changing request that doesn't carry a valid authenticity token. Separately, Rails' own form_with view helper automatically embeds a hidden authenticity_token field into every form it generates.

HOW THEY WORK TOGETHER WITHOUT MANUAL TOKEN HANDLING
------------------------------
Per this chapter, because form_with generates the token field automatically every time a form is built with it, and protect_from_forgery checks for that same token automatically on every incoming request, neither side requires the developer to write any token-handling code by hand. The two mechanisms are paired by Rails' own defaults - one produces the token, the other verifies it - with nothing extra needed in the view itself, the same end result as Blade's @csrf and Django's {% csrf_token %} achieve in their own frameworks.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly names protect_from_forgery and form_with's automatic authenticity_token field as the two responsible mechanisms, and correctly explains how their paired default behavior removes the need for any manual token handling in the view.