In register.php, the hidden token field has no name: <input type="hidden" value="<?php echo Token::generate(); ?>" /> Should it be: <input type="hidden" name="token" value="<?php echo Token::generate(); ?>" /> I needed to add that to get it to work!