Store security key in VaadinSession (#11717)

* Also removes the WRITE_SECURITY_TOKEN_FLAG flag that was defined twice
but never set

Change-Id: I02d172b7ccd230df7c59b3b17227235bea9d2e7d