title: WordPress not refreshing nonce token on the server
body: <p>I have a form in my plugin similar to this:</p>
  
  <pre><code>&lt;!-- Client form --&gt;
  &lt;form&gt;
     &lt;?php wp_nonce_field('my_form','_my_token'); ?&gt;
     &lt;!-- Additional form fields --&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>it generates those two fields:</p>
  
  <pre><code>&lt;input type="hidden" id="_my_token" name="_my_token" value="abcdefghij" /&gt;
  &lt;input type="hidden" name="_wp_http_referer" value="/wp-admin/tools.php?page=my-plugin%2Fplugin.php" /&gt;
  </code></pre>
  
  <p>When I submit this form, I validate it like this:</p>
  
  <pre><code>//Server's side check
  if(!wp_verify_nonce($_POST['_my_token'],'my_form')){
     echo 'Invalid token! Expected token: '. wp_create_nonce( 'my_form');
     exit;
  } 
  </code></pre>
  
  <p>The problem is that on the server, token never changes, it's always the same, and validation always fails in this step. If I log out from WordPress and then log in again, on the client token has changed, but on the server it's the same.</p>
  
  <p>I've tested this locally and when I log in again it always changes token on both sides, but on my production environment it only changes on the client side. </p>
  
  <p>It looks like it's cached somehow, but not sure what exactly could be. I've used WP Super Cache plugin, but it's now disabled and this issue persisted. I have multisite feature enabled on my production site, but I don't believe that's related to it. Any ideas?</p>