code: public static boolean validateToken(Controller controller, String tokenName) {
  		String clientTokenId = controller.getPara(tokenName);
  		if (tokenCache == null) {
  			String serverTokenId = controller.getSessionAttr(tokenName);
  			controller.removeSessionAttr(tokenName);		// important!
  			return StrKit.notBlank(clientTokenId) && clientTokenId.equals(serverTokenId);
  		}
  		else {
  			Token token = new Token(clientTokenId);
  			boolean result = tokenCache.contains(token);
  			tokenCache.remove(token);
  			return result;
  		}
  	}
docs: Check token to prevent resubmit.
  @param tokenName the token name used in view's form
  @return true if token is correct