title: Cakephp 3.x 'URL mismatch in POST data' with SSL
body: <h3>Setup</h3>
  
  <ul>
  <li>CakePHP 3.4.6</li>
  <li>nginx</li>
  <li>SSL redirect for all URLs</li>
  <li>The app lies within a subfolder on the webserver and the nginx-config is appropriately set. </li>
  </ul>
  
  <h3>Issue</h3>
  
  <p>On the live server with SSL (on nginx) I get the following error when using postLink() to delete data (on any form):</p>
  
  <pre><code>URL mismatch in POST data (expected '/somewhere/delete/1001' but found
  '/somewhere/delete/1001?url=%somewhere%2Fdelete%2F1001')
  
  Cake\Controller\Exception\AuthSecurityException
  
  toggle vendor stack frames
  ⟩ Cake\Controller\Component\SecurityComponent-&gt;_validatePost
  CORE/src/Controller/Component/SecurityComponent.php, line 120
  ⟩ Cake\Controller\Component\SecurityComponent-&gt;startup
  CORE/src/Event/EventManager.php, line 414
  ⟩ Cake\Event\EventManager-&gt;_callListener
  CORE/src/Event/EventManager.php, line 391
  ⟩ Cake\Event\EventManager-&gt;dispatch
  CORE/src/Event/EventDispatcherTrait.php, line 78
  ⟩ Cake\Controller\Controller-&gt;dispatchEvent
  CORE/src/Controller/Controller.php, line 506
  ⟩ Cake\Controller\Controller-&gt;startupProcess
  </code></pre>
  
  <p>Posting form and saving them works completely fine. The URL seems to be rewritten somewhere during the request.</p>
  
  <p>The HTML contains the action <code>action="/somewhere/delete/1001"</code></p>
  
  <p>So that seems to be fine. Maybe the nginx redirect is modifying this in an not allowed way. Because I have one rule like:</p>
  
  <pre><code>rewrite ^/project/abc/webroot/(.*) /project/abc/webroot/index.php?url=$1 last;
  </code></pre>
  
  <p>But I can't remove this rewrite without getting a 404.</p>
  
  <p>However, can I allow this URLs in the beforeFilter for delete action somehow?</p>