02-26-2016, 01:57 PM
I think the trick is that the token is allowed to change...it just needs to change when YOU detect input (then the users $_SESSION will be properly updated to match the token update. If someone hacks the page, they won't have the proper token in their $_SESSION and it won't work.