JS notification reports that the document is saved successfully, even if the CSRF token validation failed and the document is not actually saved.

Steps to reproduce:
1. log in with a user that has edit rights
2. open a document in edit mode (don`t think it matters which edit mode)
3. wait for the session to expire (or whatever is required to make the CSRF token invalid)
4. come back to the document opened in edit mode, make a change and press Save&Continue
5. the save is reported as successful by the JS notification
6. check the document and see that the save was not registered.
7. check the console and see that the CSRF token validation failed.

This is quite a big deal since the user's modifications can easily be lost. Happened to me a couple of times.