title: Form validation fails due missing CSRF
body: <p>A few days ago I have reset my local flask environment without having captured the dependencies via a <code>pip freeze</code> before I deleted it.  Hence I had to re-install the latest version of the entire stack.</p>
  
  <p>Now out of the blue I am no longer able to validate with forms. Flask claims CSRF would be missing.</p>
  
  <pre><code>def register():
      form = RegisterForm()
      if form.validate_on_submit():
         ...
      return make_response("register.html", form=form, error=form.errors)
  </code></pre>
  
  <p>The first time I send a <code>Get</code> I retrieve an empty <code>form.errors</code> as expected.
  Now I fill out the form and submit it and <code>form.errors</code> is showing: <code>{'csrf_token': [u'CSRF token missing']}</code></p>
  
  <p>This is so strange. I wonder if Flask-WTF has changed and I am using it wrongly.</p>
  
  <p>I can clearly see the <code>form.CSRF_token</code> exists, so why is it claiming it was missing?</p>
  
  <pre><code>CSRFTokenField: &lt;input id="csrf_token" name="csrf_token" type="hidden" value="1391278044.35##3f90ec8062a9e91707e70c2edb919f7e8236ddb5"&gt;
  </code></pre>
  
  <p>I never touched the working template, but I post it here nonetheless:</p>
  
  <pre><code>{% from "_formhelpers.html" import render_field %}
  {% extends "base.html" %}
  {% block body %}
  &lt;div class="center simpleform"&gt;
      &lt;h2&gt;Register&lt;/h2&gt;
      {% if error %}&lt;p class=error&gt;&lt;strong&gt;Error:&lt;/strong&gt; {{ error }}{% endif %}
      &lt;form class="form-signin" action="{{ url_for('register') }}" method=post&gt;
          {{form.hidden_tag()}}
          &lt;dl&gt;
              {{ render_field(form.name) }}
              {{ render_field(form.email) }}
              {{ render_field(form.password) }}
              {{ render_field(form.confirm) }}
              &lt;dd&gt;&lt;input type=submit value=Register class='btn btn-primary'&gt;
          &lt;/dl&gt;
      &lt;/form&gt;
  &lt;/div&gt;
  {% endblock %}
  </code></pre>
  
  <p>Is this a new bug?</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>I have reinstalled everything and the problem persists. </p>
  
  <p>As Martijn suggested, I am debugging into the the following method in <code>flask_wtf</code> :</p>
  
  <pre><code>def validate_csrf_token(self, field):
          if not self.csrf_enabled:
              return True
          if hasattr(request, 'csrf_valid') and request.csrf_valid:
              # this is validated by CsrfProtect
              return True
          if not validate_csrf(field.data, self.SECRET_KEY, self.TIME_LIMIT):
              raise ValidationError(field.gettext('CSRF token missing'))
  </code></pre>
  
  <p>The last condition is raising the validation error.</p>
  
  <pre><code>field.data = "1391296243.8##1b02e325eb0cd0c15436d0384f981f06c06147ec"
  self.SECRET_KEY = None (? Is this the problem)
  self.TIME_LIMIT = 3600
  </code></pre>
  
  <p>And you were right the HMAC comparison fails....both values are in every time different.</p>
  
  <pre><code>return hmac_compare == hmac_csrf
  </code></pre>
  
  <p>I have both SECRET_KEY and CSRF_SESSION_KEY in my config defined.</p>