Yes, possible.  Not likely though, CSRF tokens are usually put as the first element in the form.

Agreed, it should be made configurable, and maybe we should make it consume far less, considering it's likely to be at the start of the form.