It's surprising, and a little disappointing, that the original author had not already submitted it. I've not played around with Magento but my understanding is

It's surprising, and a little disappointing, that the original author had not already submitted it. I've not played around with Magento but my understanding is that it's based on the Zend Framework. Zend_Form has a dedicated element for preventing CSRF attacks: Zend_Form_Element_Hash. That said this looks more like a poor design choice rather than a limitation of the tools/framework used.