def test_a_csrf_delete_protected(self):
        """
        MVC: Test POST delete with CSRF
        """
        client = self.app.test_client()
        self.browser_login(client, USERNAME_ADMIN, PASSWORD_ADMIN)
        with model2_data(self.appbuilder.session, 1):
            model = (
                self.appbuilder.get_session.query(Model1)
                .filter_by(field_string="test0")
                .one_or_none()
            )
            pk = model.id
            rv = client.post(f"/model2view/delete/{pk}")
            # Missing CSRF token
            self.assertEqual(rv.status_code, 400)

        MVC: Test POST delete with CSRF
        
tests/test_mvc.py