CSRF token problem with CodeIgniter
To begin with, the session class is expecting a token named 'csrf_token_name', not one named 'csrf_salemarked_token$...'.
This blog post covers AJAX with CSRF Protection in Codeigniter 2.0.
Tank_auth is getting the token from the hidden input form field, rather than the cookie. Your AJAX requests need to get the token from the hidden field if available, or the cookie if there is no form.
I found the problem. In one of my custom libraries I have parent::_sanitize_globals() which apparently was what's causing the error. I read somewhere that if I have xss filtering turned on, I don't need to do sanitize global.