This is old, but must...get...internet...points...
Maybe you're just referring to CSRF protection on the login page, but if you mean in general:
I'm still new to the CAS protocol, but my understanding is that the only time validation happens is at the beginning before you have a session id in the service application itself. Once this is generated, no more contact with the CAS server is needed and no service ticket is needed, so CAS's ST cannot protect you from CSRF attacks.
I imagine the token you mention is the "ST" (service ticket) parameter. Again, new to this stuff, but it sounds to me like you shouldn't be able to use that more than once, so maybe that is/was a bug, or maybe the spec has changed:
However, if you still have your session cookie, you don't need the ST, so maybe that was producing that behavior.