protected function _csrfField()
    {
        $request = $this->_View->getRequest();

        if ($request->getParam('_Token.unlockedFields')) {
            foreach ((array)$request->getParam('_Token.unlockedFields') as $unlocked) {
                $this->_unlockedFields[] = $unlocked;
            }
        }
        if (!$request->getParam('_csrfToken')) {
            return '';
        }

        return $this->hidden('_csrfToken', [
            'value' => $request->getParam('_csrfToken'),
            'secure' => static::SECURE_SKIP,
            'autocomplete' => 'off',
        ]);
    }