Currently are setting
$_SESSION['formInput'] = $request->getParsedBody();
in controller methods as needed. I believe this is the best approach, even though it causes some repetition as opposed to setting it once in middleware, because it must be unset upon a successful controller action and that doesn't seem possible through middleware. Leaving it in the controller methods will be a good workflow, setting and unsetting in each method where form input is required.

Note, the middleware code that works for setting is
if ($request->isPost() || $request->isPut() || $request->isPatch()) {
$_SESSION['formInput'] = $request->getParsedBody();
}

for non-fatal errors handled in ErrorHandler::handleError(), we currently redirect to the home page and display the error message (details on dev site, generic on live site). is it better to remain on the current page (either redirect to current script or spit out complete html page within ErrorHandler)?

getting written to log file on occasion for me

[2017-04-20 19:22:21 America/New_York]btqWeb Page: GET /type: 32
message: type: 32

file: Unknown
line: 0

type 32 means CORE WARNING or something. i'm guessing there's something wrong in my php.ini file - sounds minor. i'm not sure how to debug, but not really a problem

authorization is basically 'hard coded' for admins functionality:

{% elseif key == updateColumn %} {% if authentication.user.role == 'owner' or attribute(row, 'role') != 'owner' %} <td><a href="{{ path_for(updateRoute, {"primaryKey": attribute(row, 'id')}) }}" title="update">{{ value }}</a></td>

as is delete logic:

{% elseif key == 'delete' %} {# do not show delete link for the current user (cannot delete self) or for owner rows if the current user is not and owner #} {% if attribute(row, 'username') != authentication.user.username and (authentication.user.role == 'owner' or attribute(row, 'role') != 'owner') %} <td><a href="{{ path_for(value, {"primaryKey": primaryKey}) }}" title="delete" onclick="return confirm('Are you sure you want to delete admin {{ attribute(row, 'username') }}?');">X</a></td>

-- (chunk of html problem: https://www.perl.com/pub/2002/02/20/css.html). does twig prevent it or does |raw thwart that? => using |raw is potentiall unsafe: https://vivait.co.uk/labs/safely-escape-twigs-json_encode-without-using-raw

Currently am redirecting to home with error message. - See CsrfMiddleware.