I think you misunderstand what's being described. The server didn't check it, it accepted the modified hidden field. The server should have rejected the request.