diff --git a/addons/survey/tests/common.py b/addons/survey/tests/common.py
index 3016c416c81..2a4e1581a4c 100644
--- a/addons/survey/tests/common.py
+++ b/addons/survey/tests/common.py
@@ -167,7 +167,7 @@ class SurveyCase(common.SavepointCase):
         return self.opener.post(url=url, json={'params': post_data})
 
     def _find_csrf_token(self, text):
-        csrf_token_re = re.compile("(input.+csrf_token.+value=\")([_a-zA-Z0-9]{51})", re.MULTILINE)
+        csrf_token_re = re.compile("(input.+csrf_token.+value=\")([a-f0-9]{40}o[0-9]*)", re.MULTILINE)
         return csrf_token_re.search(text).groups()[1]
 
     def _prepare_post_data(self, question, answers, post_data):
diff --git a/odoo/http.py b/odoo/http.py
index 37ee218d320..dcd36d06f81 100644
--- a/odoo/http.py
+++ b/odoo/http.py
@@ -381,13 +381,12 @@ class WebRequest(object):
         """
         return self.session.db if not self.disable_db else None
 
-    def csrf_token(self, time_limit=3600):
+    def csrf_token(self, time_limit=None):
         """ Generates and returns a CSRF token for the current session
 
-        :param time_limit: the CSRF token should only be valid for the
-                           specified duration (in second), by default 1h,
+        :param time_limit: the CSRF token validity period (in seconds), or
                            ``None`` for the token to be valid as long as the
-                           current user's session is.
+                           current user session is (the default)
         :type time_limit: int | None
         :returns: ASCII token string
         """