forms: Flask-WTF v0.14.2 doesn't remove csrf_token field from data

[slint]

Problem

Flask-WTF v0.14.2 doesn't remove the csrf_token field from Form.data any more, making certain views that used to pass the form.data dictionary as **kwargs to the models' constructor (eg. in Community creation) to fail.

Possible Solutions

(open to suggestions)

• data.pop("csrf_token") before such calls
• PR to Flask-WTF to recover/control this behavior, possibly through config (I suspect we're not the only people expanding form.data in function calls)
• Define forms using WTForms-Alchemy as already done in invenio_oauth2server.forms, and retrieve the data using form.populate_obj(c)

[slint]

Relevant: pallets-eco/flask-wtf#297