code: protected String checkConfirmationId(final HttpServletRequest request,
                                         final UtilActionForm form)
            throws Throwable {
      String reqpar = request.getParameter("confirmationid");
  
      if (reqpar == null) {
        return null;
      }
  
      if (!reqpar.equals(form.getConfirmationId())) {
        return "badConformationId";
      }
  
      return null;
    }
docs: Check for a confirmation id. This is a random string embedded
  in some requests to confirm that the incoming request came from a page
  we generated. Not all pages will have such an id but if we do it must
  match.
  
  We expect the request parameter to be of the form<br/>
  confirmationid=id<p>.
  
  @param request  Needed to locate session
  @param form
  @return String  forward to here on error. null for OK.
  @throws Throwable