wrong csrf cookie name?

[eluser]Unknown[/eluser]
I've had the same problem. When I checked the core "Security" class I noticed it never uses those two config values. In the constructor the cookie prefix is added but it doesn't use the "csrf_token_name" and "csrf_cookie_name" config values.

I added the following two lines to the constructor to solve this:
$this->_csrf_token_name = config_item('csrf_token_name');
$this->_csrf_cookie_name = config_item('csrf_cookie_name');

But this seems to be a bug no?