[BUGFIX] Abandon one time CSRF tokens

Abandon the extra security feature of having one time tokens and create tokens
which are valid during a whole login session. Additionally create only one random token,
store it in the session and create the real URL and form tokens by hashing the scope strings
with the secret session token.

To enable re-login, store the session token in the registry and retrieve it in case a
re-login happens.

Thanks to Marion Eher (Bluechip.at) for sponsoring
this fix with 75 beers during the bug auction at T3BOARD11.

Resolves: #25359
Change-Id: If37990fbc1ae3701777e8218cc1bc8760a4d6a55
Releases: 4.6, 4.5
Reviewed-on: http://review.typo3.org/1364
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel