i believe it fell out of grace because the maintainer's page disappeared. and no, it shouldn't be any more vulnerable to CSRF than a simple session-cookie system, which is what this basically is.