Contao: Remove form action

[aschempp]

Generally speaking, echoing the current request URL into the page content is insecure, one of the issues we fixed in the latest security release.

Currently, the Form component does exactly that. The input is _protected_ through the Input class, but that class is kinda deprecated and the security/encoding wouldn't work with the Request class.

There is one very simple solution though: Simply do not add a form action, if it should be the current page. Thats valid by HTML5, and e.g. suggested in https://stackoverflow.com/questions/1131781/is-it-a-good-practice-to-use-an-empty-url-for-a-html-forms-action-attribute-a

[ausi]

I will research how older browsers handle action="" for the case of customized templates.

[ausi]

action="" works as expected in all browsers I tested (including IE6)

[leofeyer]

See #1201