Error at Login - "The action you requested is not allowed

You are using form_open() and global csrf filter, so CSRF token will be set automatically.
So CSRF protection should work.

If you set the $redirect to false, you will see an Exception when CSRF check fails.
https://codeigniter4.github.io/CodeIgnit...on-failure

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper