{% csrf_token %} {# Autoescaped, so next is HTML-escaped in the hidden field. #}