I have noticed this happen occasionally with a component I am working on. I use
JHtml::_('form.token') in the form and
JSession::checkToken() or die('Invalid Token') to check it once i receive the form data.
So it is triggering the die every time. One thought I have is that on the same page is a login form that uses form tokens (that form works). They also both use the same token.
Has something changed since this article http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms was published on how to use CSRF? For how simple it is to implement I just fail to see any way what I am doing is "failing".
I am using the latest version of Joomla (3.3.6 at the time of this posting).
UPDATE: Forgot to say, the form always uses