CSRF origin check fail

This line seems to be the problem with the csrf check not working not sure why though.
// Check if session token matches form token
        if ( $origin[ $key ] != $hash )
            if($throwException)
                throw new Exception( 'Invalid CSRF token.' );
            else
                return false;