Protect forms with a token ID that is assigned to a customers session?

[drillsar]

I was wondering about this contribution http://addons.oscommerce.com/info/2028

 

I'm using the Ajax version 1.5.5

 

I seen this code in some of the forms:

 

if (isset($HTTP_POST_VARS['action']) && $HTTP_POST_VARS['action'] == 'getStates' && isset($HTTP_POST_VARS['country'])) {
ajax_get_zones_html(tep_db_prepare_input($HTTP_POST_VARS['country']), true);

 

Doesnt this need a Session Token?