this is why the params['form'] is empty: in dispatcher parseParams() starting line 416 the params['form'] ['data'] gets moved into params['data'] leaving params['form'] empty.
if (isset($params['form']['data'])) { $params['data'] = $params['form']['data']; unset($params['form']['data']); } I guess I'll submit a ticket for the security component on line 165 from: if (is_array($this->requireAuth) && !empty($this->requireAuth) && ! empty($controller->params['form'])) to if (is_array($this->requireAuth) && !empty($this->requireAuth)) but that still doesn't help with the different token key problem between $form->create hidden field output and what is put into the session. :jc --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Cake PHP" group. To post to this group, send email to cake-php@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php?hl=en -~----------~----~----~----~------~----~------~--~---