Something I noticed. In Flow we have the edit token as one of the first inputs in the forms for posts and replies.

In core we, at some time in the past, have explicitly put the token as one of the last fields in the form as a backup check on the completeness/integrity of the data being POSTed.

This due to Content-Size not being required to be present and connections being able to drop. We also give this as advise for the XHR requests: https://www.mediawiki.org/wiki/API:Edit

token: Edit token. Especially if you are not using the md5 parameter, the token should be sent as the last parameter,
or at least, after the text parameter, to prevent a bad edit from getting committed if transmission of the body is
interrupted for some reason.