{# Links that change something (approve, activate, publish, delete) are marked
data-post. The views only accept POST with a CSRF token (Lucas, 6 Oct 2026),
so a crafted link a signed-in staff member opens can no longer change data.
A click on one submits this form to the link's address instead of
following it. Kept in its own script: an error elsewhere must not stop it. #}