'Please note that this method generates lots of false positives and
negatives. Read the github issue for more information.
:see: https://github.com/andresriancho/w3af/issues/120
:return: True if the CSRF token is NOT verified by the web application'

def _is_token_checked(self, freq, token, orig_response):

    token_pname_lst = token.keys()
    token_value = token[token_pname_lst[0]]
    mutants = create_mutants(freq, [token_value[::(-1)]], False, token_pname_lst)
    for mutant in mutants:
        mutant_response = self._uri_opener.send_mutant(mutant)
        if (not self._is_resp_equal(orig_response, mutant_response)):
            return True
    return False
