Ok, problem solved! I screwed up and put the Security Patch code:

$form .= '<input type="hidden" name="securityToken" value="' . $_SESSION['securityToken'] . '" />';

in the catalog/includes/functions/html_output.php file instead of the admin/!

Sometimes I skim through some critical details!