Don't work CSRF secutiry (dubl submit)

CSRF is working if you do so:

<input type="hidden" name="csrf" value="{{ security.getToken() }}">

But still does not work if you do so:

{{ form.render('csrf', ['value': security.getToken()]) }} (the value is not updated)

Found the cause: when the transfer of the entity (model) to a form does not work $element->close() on the elements. This is a bug or a feature?

use:

use Phalcon\Forms\Element\Hidden;
use Phalcon\Validation\Validator\Identical;

class UserRegisterForm extends Form
{

    public function initialize($entity = null, $options = null)
    {
         //... code ...

         // CSRF
        $csrf = new Hidden('csrf');
        $csrf->addValidator(new Identical([
            'accepted' => $this->security->getSessionToken(),
            'message' => 'CSRF validation failed'
        ]));
        $this->add($csrf);
    }
}

Controler o Micro:

 $params = [];

 $form = new UserRegisterForm();

if ($this->request->isPost()) {

    if ($form->isValid($this->request->getpost()) != false) {

    // ... code ...
        if ($user->save()) {

                 return $this->response->redirect(['for' => 'user.register.success']);

        }
    }
}

// important
$this->view->form = $form;

$this->tag->setTitle("Register");
echo $this->view->render('user/register', $params);

Template:

{{ form.render('csrf', ['value': security.getToken()]) }}

It is a bad option. This will reset all the fields that I need

use simple:

<div>{{ hidden_field(security.getTokenKey(), "value": security.getToken()) }}</div>

in controller:

if ($this->security->checkToken()) {
           // code...
}