action not allowed on form validation

According to the documentation, "If you use the form helper the form_open() function will automatically insert a hidden csrf field in your forms."

Is it possible you are inserting the fields twice and they are being sent as an array? What do you see when you view the document source of your login page?