Jawfin
3
As Cake is a server-side PHP framework I understand why they stopped attempting to support client-side javascript stuff.
I put together my approach to AJAX which uses both CSRF & form tampering protection here:-
I can only assume its a correct working approach as no-one yet has told me different!