Hidden & honeypot fields

This form includes a hidden CSRF token (must be echoed back exactly) and a honeypot field named website that must be submitted empty. Real users never see or fill it in.