title: ZF2 form's CSRF validates even with invalid values
body: <p>I have several forms that use the CSRF input. For example, in the constructor of my form, it looks like this:</p>
  
  <pre><code>    $this-&gt;add(array (
          'name' =&gt; 'csrf',
          'type' =&gt; 'Csrf',
          'attributes' =&gt; array(
              'id' =&gt; 'csrf'
          )
      ));
  </code></pre>
  
  <p>Just for kicks, I tried using Firebug to change the token value of the CSRF input and submitting the form, just to see what would happen. The result: it still validated. I even dumped the $_POST data to confirm that the invalid token was being submitted. What's more, I tried setting the timeout to 10 seconds, and the same thing happened: the form seemed to be ignoring the CSRF input and validating the form whether it was OK or not. The code is as follows:</p>
  
  <pre><code>    $this-&gt;add(array (
          'name' =&gt; 'csrf',
          'type' =&gt; 'Csrf',
          'attributes' =&gt; array(
              'id' =&gt; 'csrf'
          ),
          'options' =&gt; array(
              'csrf_options' =&gt; array(
                  'timeout' =&gt; 10
              )
          )
      ));
  </code></pre>
  
  <p>I even tried adding a filter for the CSRF element to the form's input filter, but again, it still passed when it bloody well shouldn't have.</p>
  
  <p>Is there something else I should be doing here that I'm not? I don't want to add this to my form if it's not going to actually do anything.</p>
  
  <p>EDIT: Here's a <a href="http://pastie.org/9748405" rel="nofollow">link</a> to the code for my form and my controller action. Note that, while the form's method getInputFilter has validators for csrf, sex, and role, the result is the same without them.</p>