What are default Zend Session handling best practices to prevent Cross Site Request Forgery?

Question

I have enjoyed the David Powers book Adobe Dreamweaver CS5 with PHP:  Training from the Source - and have put many of the examples into practice.  I have a security related concern that may be tied to the Zend::Auth example in the book.  While this is installed an working on my site:
<?php
$failed = FALSE;
if ($_POST) {
  if (empty($_POST['username']) || empty($_POST['password'])) {
    $failed = TRUE;
  } else {
    require_once('library.php');
    // check the user's credentials
    try {
      $auth = Zend_Auth::getInstance();
      $adapter = new Zend_Auth_Adapter_DbTable($dbRead, 'user', 'login', 'user_pass', 'sha1(?)');
      $adapter->setIdentity($_POST['username']);
      $adapter->setCredential($_POST['password']);
      $result = $auth->authenticate($adapter);
      if ($result->isValid()) {
        $storage = $auth->getStorage();
        $storage->write($adapter->getResultRowObject(array(
          'ID', 'login',  'user_first', 'user_last', 'user_role')));
        header('Location: /member/index.php');
        exit;
      } else {
        $failed = TRUE;
    } catch (Exception $e) {
      echo $e->getMessage();
if (isset($_GET['logout'])) {
  require_once('library.php');
  try {
    $auth = Zend_Auth::getInstance();
    $auth->clearIdentity();
  } catch (Exception $e) {
    echo $e->getMessage();
Apparently, there is  very limited protection against Cross Site Request Forgery, where the resulting SessionID could be easily hijacked?  I am using the Zend Community edition (I have 1.11.11).     I have an observation from a client that this authentication is not up to snuff. 
To boil it down: 
1.  Is there a Zend configuration file that might have some settings to upgrade the Session and or authentication security basics? I'm wondering specifically about the settings in /library/Zend/session.php? Ie secure the session against a changing user IP, and invoking some other session handling stuff (time-out etc). 
2.  If I understand it correctly, "salting" won't help with this, unless it's added/checked via a hidden POST at login time? 
Ideally, the man himself, David Powers would jump in here - but I'll take any help I can get!
Thanks!

Answer 1

Might ask them over here.
http://forums.asp.net/1146.aspx/1?MVC
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.