nice article, but i have a question:

You wrote: “For more to test this you may try to make the same form somewhere else on the web and to point the action to http://www.stoimen.com/projects/php.secure.forms/”

I copied the sourccode from the demo and pasted it in a webpage on my local server. (with the action to your webpage). First time after submitting the form from the local server i could see the value on your page. (because the token is right). By submitting the form more then 1 time, i see dont’hack on your page (because the token changed).
Is this the right behavior? I thougt first time after submitting i see “don’t hack”, because the form was not submitted from your page.