Indeed through portal users can post a message. Form used in order to do so include a csrf token. However this one should not be propagated to message_post because it is not a mail_message model field. This creates unnecessary warnings. Closes #13956 .