code: public static String getToken(HttpServletRequest request, ActionMapping mapping)
      {
          if (mapping instanceof PageFlowActionMapping && ((PageFlowActionMapping) mapping).isPreventDoubleSubmit()) {
              HttpSession session = request.getSession();
              String token = (String) session.getAttribute(Globals.TRANSACTION_TOKEN_KEY);
              if (token != null) return token;
              token = TokenProcessor.getInstance().generateToken(request);
              request.getSession().setAttribute(Globals.TRANSACTION_TOKEN_KEY, token);
              return token;
          }
  
          return null;
      }
docs: Get or generate a token used to prevent double submits to an action.  The token is stored in the session,
  and checked (and removed) when processing an action with the <code>preventDoubleSubmit</code> attribute
  set to <code>true</code>.