4.5 got token support, but token verification needs to be done by an extension. The problem is that it breaks all ajax code that does not use ezjscore function ( .ez() ), so until that is handled a bit more elegantly it is not included by default but provided to customers that are willing to adapt their code to make it work.
This is indeed an issue. I would recommend, as a temporary solution which however impacts the end-user a bit, using the recaptcha extension for eZ Publish : http://projects.ez.no/recaptcha.
Secondly, i would recommend filing a request for enhancement there : http://issues.ez.no/ezpublish , detailing the feature.
Cheers !
--
Nicolas Pastorino
Director Community - eZ
Member of the Community Project Board
