diff --git a/CHANGES.rst b/CHANGES.rst
index 3691db5..bd6d9ba 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -14,7 +14,11 @@ New features:
 
 Bug fixes:
 
-- *add item here*
+- Removed ``RedirectTo`` patch.  The patch has been merged to
+  ``Products.CMFFormController`` 3.0.7 (Plone 4.3 and 5.0) and 3.1.2
+  (Plone 5.1).  Note that we are not requiring those versions in our
+  ``setup.py``, because the code in this package no longer needs it.
+  [maurits]
 
 
 3.0.19 (2016-08-19)
diff --git a/plone/protect/configure.zcml b/plone/protect/configure.zcml
index 54212cc..d31bd7c 100644
--- a/plone/protect/configure.zcml
+++ b/plone/protect/configure.zcml
@@ -52,12 +52,6 @@
 
     <include package="collective.monkeypatcher" />
 
-    <monkey:patch
-        description="Allows ATContentTypes add forms to append auth token"
-        class="Products.CMFFormController.Actions.RedirectTo.RedirectTo"
-        original="__call__"
-        replacement=".monkey.RedirectTo__call__"
-        />
     <monkey:patch
         description="Special handling for write on read Zope2 locking issues"
         class="webdav.Lockable.LockableItem"
diff --git a/plone/protect/monkey.py b/plone/protect/monkey.py
index 06c8dae..49629d8 100644
--- a/plone/protect/monkey.py
+++ b/plone/protect/monkey.py
@@ -1,32 +1,8 @@
-from urlparse import urlparse, urljoin
 from plone.protect.auto import safeWrite
 import inspect
 from Products.PluggableAuthService import utils as pluggable_utils
 
 
-def RedirectTo__call__(self, controller_state):
-    url = self.getArg(controller_state)
-    context = controller_state.getContext()
-    # see if this is a relative url or an absolute
-    if len(urlparse(url)[1]) == 0:
-        # No host specified, so url is relative.  Get an absolute url.
-        url = urljoin(context.absolute_url()+'/', url)
-    url = self.updateQuery(url, controller_state.kwargs)
-    request = context.REQUEST
-    # this is mostly just for archetypes edit forms...
-    if 'edit' in url and '_authenticator' not in url and \
-            '_authenticator' in request.form:
-        if '?' in url:
-            url += '&'
-        else:
-            url += '?'
-        auth = request.form['_authenticator']
-        if isinstance(auth, list):
-            auth = auth[0]
-        url += '_authenticator=' + auth
-    return request.RESPONSE.redirect(url)
-
-
 def wl_lockmapping(self, killinvalids=0, create=0):
     has_write_locks = hasattr(self, '_dav_writelocks')
     locks = self._old_wl_lockmapping(killinvalids=killinvalids, create=create)
@@ -65,4 +41,4 @@ def marmoset_patch(func, replacement):
 if hasattr(pluggable_utils, 'checkCSRFToken'):
     marmoset_patch(pluggable_utils.checkCSRFToken, pluggableauth__checkCSRFToken)
 if hasattr(pluggable_utils, 'getCSRFToken'):
-    marmoset_patch(pluggable_utils.getCSRFToken, pluggableauth__getCSRFToken)
\ No newline at end of file
+    marmoset_patch(pluggable_utils.getCSRFToken, pluggableauth__getCSRFToken)