Running 2.7.3 with secure forms, everything works fine passing the xid_hash etc... until somebody clicks the back button or tries to reload after submitting a form.
It's the usual issue of it trying to reuse the same xid, but I can't refresh the xid as they're just clicking back.
I notice in the 2.8 changelog developers section it's deprecated a load of xid functions, do we know if this somehow fixes this?