Invalid Security Token Troubleshooting page

[atoav]

I have a issue with a invalid security token and found the the troubleshooting page only partly helpful.

• It says you can set things up in system.yaml, but in another place it says you should never edit system/config/system.yaml and always add your own settings in user/config/system.yaml. I found that only after 2 hours of googling. Adding a notice here would make sense, because the first thing you ask yourself is: "Where was that system.yaml again?" and the answer you get can be one of two things.
• It says you should check if your tmp variable is properly setup, but tells you no reliable way to do so or what a properly setup tmp folder should look like (with permissions etc). I still have no idea on this topic, but a bit more clarity would help at this point.