Hi bluebobbo, i guess know why you have problem.
Specifically, $_SESSION['token'] does not hold a value. I couldn't find anywhere in any of the files where $_SESSION['token'] was assigned a value, thus the array_search wasn't matching anything. Also note, that array_search's second parameter must be the array, so it'd actually be array_search($_SESSION['token'], $arr_data['token']) for valid syntax. There is a value in $arr_data['token'], just none in $_SESSION['token'].
Do you have generate your token in first ? To generate a new token (that is an element in $_SESSION['token']) you must call the PHP script without url data, like that :
Then, you can get back this token in Construct2 with AJAXRSA.LastData and use it for next request to secure your data.
Silly question : Do you have a session_start(); at the top of your PHP Script ?
I hope you will resolve your problem with that.