public function check($key, $token, $timespan = null, $multiple = false)
	{
		$key = $result = preg_replace('/[^a-zA-Z0-9]+/', '', $key);

		if (!$token) {
			throw new \Exception('Missing CSRF form token.');
		}

		$session_token = $this->session->get($this->session_prefix . $key);
		if (!$session_token) {
			throw new \Exception('Missing CSRF session token.');
		}

		if (!$multiple) {
			$this->session->set($this->session_prefix . $key, null);
		}

		if (sha1($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']) != substr(base64_decode($session_token), 10, 40)) {
			throw new \Exception('Form origin does not match token origin.');
		}

		if ($token != $session_token) {
			throw new \Exception('Invalid CSRF token.');
		}

		// Check for token expiration
		if ($timespan != null && is_int($timespan) && intval(substr(base64_decode($session_token), 0, 10)) + $timespan < time()) {
			throw new \Exception('CSRF token has expired.');
		}
	}