diff --git a/includes/form.inc b/includes/form.inc
index f1691ad..c00def9 100644
--- a/includes/form.inc
+++ b/includes/form.inc
@@ -1175,7 +1175,7 @@ function drupal_validate_form($form_id, &$form, &$form_state) {
   // If the session token was set by drupal_prepare_form(), ensure that it
   // matches the current user's session. This is duplicate to code in
   // form_builder() but left to protect any custom form handling code.
-  if (isset($form['#token'])) {
+  if (!empty($form['#token'])) {
     if (!drupal_valid_token($form_state['values']['form_token'], $form['#token']) || !empty($form_state['invalid_token'])) {
       _drupal_invalid_token_set_form_error();
       // Stop here and don't run any further validation handlers, because they
@@ -1836,7 +1836,7 @@ function form_builder($form_id, &$element, &$form_state) {
       // If the session token was set by drupal_prepare_form(), ensure that it
       // matches the current user's session.
       $form_state['invalid_token'] = FALSE;
-      if (isset($element['#token'])) {
+      if (!empty($element['#token'])) {
         if (empty($form_state['input']['form_token']) || !drupal_valid_token($form_state['input']['form_token'], $element['#token'])) {
           // Set an early form error to block certain input processing since that
           // opens the door for CSRF vulnerabilities.
diff --git a/modules/simpletest/tests/form.test b/modules/simpletest/tests/form.test
index 0bf6c8c..6c90ec3 100644
--- a/modules/simpletest/tests/form.test
+++ b/modules/simpletest/tests/form.test
@@ -691,6 +691,14 @@ class FormValidationTestCase extends DrupalWebTestCase {
   }
 
   /**
+   * Tests that a form with a disabled CSRF token can be validated.
+   */
+  function testDisabledToken() {
+    $this->drupalPost('form-test/validate-no-token', array(), 'Save');
+    $this->assertText('The form_test_validate_no_token form has been submitted successfully.');
+  }
+
+  /**
    * Tests partial form validation through #limit_validation_errors.
    */
   function testValidateLimitErrors() {
diff --git a/modules/simpletest/tests/form_test.module b/modules/simpletest/tests/form_test.module
index 602b409..946c9d8 100644
--- a/modules/simpletest/tests/form_test.module
+++ b/modules/simpletest/tests/form_test.module
@@ -37,6 +37,13 @@ function form_test_menu() {
     'access callback' => TRUE,
     'type' => MENU_CALLBACK,
   );
+  $items['form-test/validate-no-token'] = array(
+    'title' => 'Form validation without a CSRF token',
+    'page callback' => 'drupal_get_form',
+    'page arguments' => array('form_test_validate_no_token'),
+    'access callback' => TRUE,
+    'type' => MENU_CALLBACK,
+  );
   $items['form-test/limit-validation-errors'] = array(
     'title' => 'Form validation with some error suppression',
     'page callback' => 'drupal_get_form',
@@ -455,6 +462,27 @@ function form_test_validate_required_form_no_title_submit($form, &$form_state) {
 }
 
 /**
+ * Form builder for testing submission of a form without a CSRF token.
+ */
+function form_test_validate_no_token($form, &$form_state) {
+  $form['submit'] = array(
+    '#type' => 'submit',
+    '#value' => 'Save',
+  );
+
+  $form['#token'] = FALSE;
+
+  return $form;
+}
+
+/**
+ * Form submission handler for form_test_validate_no_token().
+ */
+function form_test_validate_no_token_submit($form, &$form_state) {
+  drupal_set_message('The form_test_validate_no_token form has been submitted successfully.');
+}
+
+/**
  * Builds a simple form with a button triggering partial validation.
  */
 function form_test_limit_validation_errors_form($form, &$form_state) {