More rest stuff.

Hi all:

The code that invokes the rest handler from cgi/client.py doesn't
incorporate anti-csrf code. It didn't exist at the time they followed
the code in handle_xmlrpc to create handle_rest.

Fortunately closing this issue is more or less a simple copy from the
current handle_xmlrpc. I have committed this change.

I have the following outstanding patches:

  1 if somebody tries to change or delete a protected property, they
    get a 400 Usage Error. Also correct OPTIONS method on the property
    to Allow GET, OPTIONS only. Making the field read only.
  2 if somebody tries to delete a required property, they get a 409
    ValueError
  3 hyperdb __getattr__ KeyError re-raised as AttributeError, so the
    code would match comment.
  4 fixing OPTIONS Allow headers. E.G. on a collection rest/class you can
    only do GET, POST, OPTIONS. The current values include PUT, DELETE...
  4a) For rest/data/class/id/properties return 404 if they specify a
      property that doesn't exist.
  5) A fix for processing error messages if client requests application/xml

Also remove HEAD for OPTIONS as we have no HEAD support for anything
AFAICT.

Anybody see a reason I shouldn't commit these?

Open question is should we support HEAD? Supporting HEAD here
is a little less resource intensive than the html web interface. We
can cut out a fair amount of processing. but will still have db
access.

Also does anybody know if Access-Control-Allow-Methods and Allow
should always be the same? I really don't understand what
Access-Control-Allow-Methods is for.

Have a great week.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.