Turn a submitted HTML form (all string values) into a typed JSON object:
"true"/"false" โ bool, integer/float text โ number, everything else stays
a string.
Render a page that contains a POST form, putting a CSRF token in scope as
csrf_token and setting the cookie when a fresh one had to be minted. Every
template rendered through this must echo the token into a hidden _csrf
field, or its form will be rejected by crate::csrf::verify on submit.