Miscellaneous Changes

The last bullet can be deleted. CF10 Final restored cfform's default form action. To prevent XSS, CF seemingly uses encodeForHTMLAttribute() on the CGI.SCRIPT_NAME portion and encodeForURL() on each URL param's name & value.

Thanks,

-Aaron

About the last bullet, the language is a little unclear. But "does not generate the same", it seems you mean "does not generate the current URL as the action". That may be a bit more clear. What's not clear is what will be generated.. Might be helpful to indicate. Also, as for the jvm.config tweak, doesn't that need a - in front of the D?