feat(ror/form_basics): link to docs, explain HTTP method and CSRF relation

ruby_on_rails/forms_and_authentication/form_basics.md

@@ -204,7 +204,7 @@ Forms aren't really designed to natively delete objects because browsers only su
 You get Rails to add this to your form by passing an option to `form_with` called `:method`, e.g.:
 
 ```ruby
-  form_with(url: search_path, method: "patch")
+  form_with(url: user_profile_path, method: "patch")
 ```
 
 ### Controller-side refresher

ruby_on_rails/forms_and_authentication/project_forms.md

@@ -30,7 +30,9 @@ You'll get good at setting up apps quickly in the coming lessons by using more o
 
 The first form you build will be mostly HTML (remember that stuff at all?).  Build it in your New view at `app/views/users/new.html.erb`.  The goal is to build a form that is almost identical to what you'd get by using a Rails helper so you can see how it's done behind the scenes.
 
-1. Build a form for creating a new user. See the [W3Schools page for forms](https://www.w3schools.com/tags/tag_form.asp) if you’ve totally forgotten how they work. Specify the `method` and the `action` attributes in your `<form>` tag (use `$ rails routes` to see which HTTP method and path are being expected based on the resource you created).  Include the attribute `accept-charset="UTF-8"` as well, which Rails naturally adds to its forms to specify Unicode character encoding.
+Read [section 2.1 and 2.2 of Rails guide for routing](https://guides.rubyonrails.org/routing.html#resources-on-the-web), the HTTP methods like GET, POST, PATCH, DELETE, etc have different meaning for example a search form should use GET method because it is just reading the data/resource and a user profile update form would use PATCH or PUT since it's modifies the data. You should not use GET method to perform non-GET (anything other than GET) operation on a resource, because ruby on rails will not check for CSRF token on non-GET requests. Read [section 4 of Rails Security Guide](https://guides.rubyonrails.org/security.html#csrf-countermeasures).
+
+1. Build a form for creating a new user. Read the [MDN docs reference for form element](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/form) if you’ve totally forgotten how they work. Specify the `method` and the `action` attributes in your `<form>` tag (use `$ rails routes` to see which HTTP method and path are being expected based on the resource you created).  Include the attribute `accept-charset="UTF-8"` as well, which Rails naturally adds to its forms to specify Unicode character encoding.
 
 1. Create the proper input tags for your user's fields (email, username and password).  Use the proper password input for "password".  Be sure to specify the `name` attribute for these inputs.  Make label tags which correspond to each field.