protected boolean isTokenValid(HttpServletRequest
                                     request) {
    HttpSession session = request.getSession(false);
    if (session == null) {
      return false;
    }
    String saved = (String)
        session.getAttribute(ApplictionResources.getTransactionTokenKey());
    if (saved != null) {
      String token = request.getParameter(ApplictionResources.getTransactionTokenKey());
      if (token != null) {      //security vulnerability
        return saved.equals(token);
      }
    }
    return true;
  }