TYPO3 Core

Wizards used to be registered by defining a script path
to an entry script for a wizard. Since we now aim to reduce
the entry scripts, wizards should be called through
mod.php and be registered accordingly.
However with the additional requirement of adding
CSRF protection for all mod.php calls, we cannot hard code
the script URLs for wizards any more. Instead BackendUtility::getModuleUrl
should be used, which adds the CSRF protection token.
Since this token is session dependend and TCA might be cached,
we need a new way to register a wizard by just specifying
the module name in TCA.

The FormRenderer should then take care to call BackendUtility::getModuleUrl