This is because recent versions of webform has made %session token available for authorized users only. counting and saving vote into database relies on %session token, therefor is broken now.

A quick fix for private sites is breaking webform code (uh-oh). You have to edit code of webform module and move "'%session' => $_SESSION," from "unsafe" array to to "safe".

.. because no-one needs permanent fix or some major changes in this D5 module ;)