how to know if a form_alter is being invoked through an ajax request?
This is likely an AHAH issue. See Adding dynamic form elements using AHAH. The form is loaded from the cache and then the form alter is called irrespective of whether it is full post request or via Ajax. You might want to change the logic in a way to save the result of checking the token the first time the form_alter is called in a $_SESSION variable (Save the token in the session variable). And change the logic to include an additional check for the presence of the same $_SESSION variable if there is no token value, and if present if that token is valid (for security reasons).