We're all aware of the fact that Form API in Drupal automatically protects us against Cross-site request forgery attacks (a.k.a. CSRF) by using tokens which are added to each form. If a developer uses Form API in a proper way (and he must), there's no need to worry…