It's just a default installation. I have Chrome inspector up and there doesnt' appear to be any POST information when clicking submit.
Request URL: https://clients.evaske.com/plugin/order/main/checkout/order
Request Method: POST Status Code: 200 OK Request Headersview parsed
POST /plugin/order/main/checkout/order HTTP/1.1 Host: clients.evaske.com Connection: keep-alive Content-Length: 76 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Origin: https://clients.evaske.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.62 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: https://clients.evaske.com/plugin/order/main/checkout/order Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: blesta_sid=13577698495cf79f213f56fb9dd48edf
Form Dataview sourceview URL encoded _csrf_token: 674654b7303859437bea93ecbdab469b632529ba7bfadcb6b516fa211ed7761c Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection: close Content-Type: text/html Date: Fri, 30 Aug 2013 15:51:02 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache Server: Apache Transfer-Encoding: chunked X-Powered-By: PHP/5.3.27 Response Headersview source
Tried in Safari, Chrome and Firefox. All with the same error. I have tried removing the package and re-creating. This does nothing.
If you want to see for yourself:
URL: https://clients.evaske.com/plugin/order/main/checkout/order
Use the username joe.bloggs and the password changeme.