{% extends shell('login') %}

{% block title %}{{ heading }}{% endblock %}

{% block content %}

<h1 class="h2 mb-3">{{ heading }}</h1>

{% with messages = get_flashed_messages(with_categories=true) %}
    {% for category, message in messages %}
        <div class="alert alert-{{ category }}" role="alert">{{ message }}</div>
    {% endfor %}
{% endwith %}

<div class="row">
    <div class="col-md-6">
        {# The GET only shows this button, so a mail scanner that opens every
           link confirms nothing. The POST, with its CSRF token, does. #}
        <form method="post">
            {{ form.hidden_tag() }}
            <p>{{ text }}</p>
            <button type="submit" class="btn btn-primary">{{ button }}</button>
        </form>
    </div>
</div>

{% endblock %}