CSRF on module forms for anon users
If you look at drupal_prepare_form() it says


  since tokens are session-bound and forms displayed to anonymous users are very likely cached, we cannot assign a token for them.


If you do want to go ahead with this, the following works when quickly tested with the default search and comment forms.

function MYMODULE_form_alter(&amp;$form, &amp;$form_state, $form_id) {
  if (!isset($form['#token'])) {
    $form['#token'] = $form_id;
    $form['form_token'] = array(
      '#id' =&gt; drupal_html_id('edit-' . $form_id . '-form-token'), 
      '#type' =&gt; 'token', 
      '#default_value' =&gt; drupal_get_token($form['#token']),
    );
  }
}


Be careful about page caching however (and a reverse proxy if you use one) if you do go down this road.