you're missing the point. If the good engineers at github are getting this wrong then chances are this is a common security flaw. Hence a plea to the framework

you're missing the point. If the good engineers at github are getting this wrong then chances are this is a common security flaw. Hence a plea to the framework to make this a default.