Q: what is the point of splitting the generated random value in an "index" and a "token" part?

[gggeek]

It seems to me that one could generate just one 'token' string, and use that as the index for the array stored in the session which holds the token data.

Then the validation would simply need to check if there is an array index matching the token received in the request, instead of matching both the array index and the 'token' value inside the data structure.

The code would benefit by being simplified, and the html form would only need to show 1 input field for the token instead of 2.

I see no extra security added by doing things the current way - but I am sure I must be missing something...