fixes bug 869172 - token protection forced no matter what the form says