A token is created every time you load the form to add a release. It's stored in the form data as a hidden field and also in your session. It's part of our protection scheme for CSRF.
Okay, but that doesn't tell me why I'm getting the error.
If it's a hidden field, it should just get passed back through whatever method the page tells my browser to send it back as, and I shouldn't be getting the "Invalid Token" error, right?
