title: Html.AntiForgeryToken() still required?
body: <p>Is <code>@Html.AntiForgeryToken()</code> still required in ASP.NET .NET4.6 vNext? </p>
  
  <p>The form decorations have changed to</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;form asp-controller="Account" 
        asp-action="Login" 
        asp-route-returnurl="@ViewBag.ReturnUrl" 
        method="post" 
        class="form-horizontal" 
        role="form"&gt;
  </code></pre>
  
  <p>From this</p>
  
  <pre class="lang-html prettyprint-override"><code>@using (Html.BeginForm("Login", 
                         "Account", 
                         new { ReturnUrl = ViewBag.ReturnUrl }, 
                         FormMethod.Post, 
                         new { @class = "", role = "form" }))
  </code></pre>
  
  <p>And no longer include this</p>
  
  <pre><code>@Html.AntiForgeryToken()
  </code></pre>
  
  <p>The Controller Actions are still marked with the <code>ValidateAntiForgeryToken</code> attribute as expected though so where exactly is it coming from? Automagically?</p>
  
  <pre class="lang-cs prettyprint-override"><code>[HttpPost]
  [AllowAnonymous]
  [ValidateAntiForgeryToken]
  public async Task&lt;IActionResult&gt; Login(LoginViewModel model, string returnUrl = null)
  </code></pre>