kohana/core — pull request #324 by mAiNiNfEcTiOn (2012-12-13 15:42:04+00:00)
Title: Changed the Security::token() method to remove the token from the Session

Changed the token() method to make a get_once, so that the token does not remain in the Session.
Check the case where, the user actually uses your form once, and it is validated correctly and does the desired process.
The CSRF protection's token used in the whole process remains in the Session, therefore allowing the user to ignore your form and make posts directly to the endpoint of your form, therefore only validating with the token in the Session, until the Session ends.