title: Flask-WTF set time limit on CSRF token
body: <p>I'm currently using Flask-WTF v0.13.1, i have a few forms on my website, all created including the CSRF token.</p>
  
  <p>For some reasons i have to set a different expiration on each form, so far i could set manually the <code>time_limit</code> value upon creating the csrf token. </p>
  
  <p>I would like to update to the v0.14, according to the <a href="https://github.com/lepture/flask-wtf/blob/master/docs/changelog.rst#version-014" rel="noreferrer">changelog</a> <code>time_limit</code> is gone and there is no reference in the docs on how to change it anymore. 
  Looking in the source code i saw that the form has a <code>csrf_time_limit</code> meta parameter. </p>
  
  <p>I tried to set that parameter on my form:</p>
  
  <pre><code>from flask_wtf import FlaskForm
  
  class myForm(FlaskForm):
      class Meta:
          csrf_time_limit = 7200
  
      content = TextAreaField('content')
  </code></pre>
  
  <p>Although debugging the <code>csrf.py</code> <a href="https://github.com/lepture/flask-wtf/blob/master/flask_wtf/csrf.py" rel="noreferrer">module</a> i see that the <code>validate_csrf_token</code> of <code>_FlaskFormCSRF</code> is actually never called. </p>
  
  <p>The method <code>validate_csrf</code> is called within the method <code>protect()</code> instead, in this case the meta parameter is never considered. </p>
  
  <p>I don't understand if this is a bug of the package or if i'm missing something. </p>
  
  <p>UPDATE:</p>
  
  <p>Example code: </p>
  
  <p>app.py </p>
  
  <pre><code>from flask import Flask, render_template, request
  from flask_wtf.csrf import CSRFProtect
  from flask_wtf import FlaskForm
  from wtforms import IntegerField
  
  csrf = CSRFProtect()
  app = Flask(__name__)
  app.config.update(dict(
      SECRET_KEY="super secret key"
  ))
  
  csrf.init_app(app)
  
  class MyForm(FlaskForm):
      class Meta:
          csrf_time_limit = 1
  
      id = IntegerField('id')
  
  @app.route("/", methods=['GET', 'POST'])
  def test_form_csrf():
      if request.method == 'POST':
          myForm = MyForm(request.form)
          print(myForm.id.data)
  
      return render_template('test_form.html', myForm= MyForm())
  </code></pre>
  
  <p>templates/test_form.html</p>
  
  <pre><code>&lt;form method="post" action="/"&gt;
      &lt;input type="hidden" name="csrf_token" value="{{ csrf_token() }}" /&gt;
      {{ myForm.id }}
      &lt;input type="submit" value="test" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>requirements.txt </p>
  
  <pre><code>click==6.7
  Flask==0.12.2
  Flask-WTF==0.14.2
  itsdangerous==0.24
  Jinja2==2.10
  MarkupSafe==1.0
  Werkzeug==0.14.1
  WTForms==2.1
  </code></pre>
  
  <p>project structure </p>
  
  <pre><code>app.py
  templates
  |
  --- test_form.html
  </code></pre>
  
  <p>To run the code, </p>
  
  <pre><code>FLASK_APP=app.py flask run
  </code></pre>
  
  <p>I also put a debug breakpoint on <a href="https://github.com/lepture/flask-wtf/blob/master/flask_wtf/csrf.py#L99" rel="noreferrer">this line</a> to check the actual value of <code>time_limit</code>, the value is always <code>3600</code>.  </p>