Resolve #3511828 "Fix favorites route"

Closes #3511828

tests/src/FunctionalJavascript/FavoritesTest.php

@@ -112,6 +112,13 @@ class FavoritesTest extends TypeTrayWebDriverTestBase {
     $favorite_link = $assert_session->elementExists('css', '.type-tray-teaser--one .favorite-link');
     $favorite_link->click();
     $this->saveHtmlOutput();
+    // Verify the route is protected against CSRF, so visiting the bare URL
+    // doesn't remove it from favorites.
+    $this->drupalGet('/type-tray/favorites-action/one/remove');
+    $this->drupalGet('/node/add');
+    $assert_session->pageTextContains('Favorites');
+    $assert_session->elementExists('css', '.type-tray-category.category--type-tray__favorites');
+    $assert_session->elementExists('css', '.type-tray-category.category--type-tray__favorites .type-tray-teaser--one');
 
     // Log in as a different user and verify the favorites don't mix up.
     $user2 = $this->createUser([