2017-11-28 UTC
# 
mapkyca the token is generated over site secrete + action + time + _session id_ ... so maybe if the form is generated on https but posted to http, then it's not beyond the realms of possibility that the session id has changed, although I've no real data here. network log might help with this (chrome dev console allows you to record, ff might as well)