Hi,

yes, in 6.1.20 the tokens are check as well.

Another thing is that the tokens don't need to be based on session, customers are allowed to exchange token implementation.

So I think about this fix more as "Action URLs should not be trigger after login"

Anyway, I tried it with control panel on master and it doesn't work well, current behavior works better than this fix, because with this fix we lost whole control panel navigation.

So right now I'm looking at possibilities how to keep as much as possible from the original request and use the portlet render URL instead of the action URL.