EllisLab/CodeIgniter — pull request #703 by johnnicely (2011-11-24 07:06:57+00:00)
Title: Changed form_open() to compare $action against base_url()

Checking for strpos($action, $CI->config->site_url()) === FALSE cause
CSRF token to not be added in form_open() output. When site_url()'s
first parameter ($uri) is empty, site_url's return value is the base
URL plus the $CI->config->item('index_page') value. form_open() and
CodeIgniter's URI routing do not require index.php to be in the URL, so
any call to form_open() in which the $action parameter does not have
index.php will always return false for the strpos() call.