An invalid "results=" parameter is not a CSRF threat

Since results keys are removed from the session once they're used,
refreshing a page with a results= parameter would throw up the CSRF
interstitial.  That behaviour is almost as bad as a browser asking if
you want to resubmit the POST data on refresh, which is the reason for
the MaybeRedirectForResults() framework in the first place.
Ensure action results are deleted from the session upon first use

This removes the inconsistent display of action results after a page
reload and keeps the session from growing unbounded.  Previously the
delete didn't update the session store unless a subsequent component
incremented the session counter.  Quick ticket creation does not, for
example.
Test that action results are only displayed once and don't trigger CSRF
Merge branch '4.0/allow-any-results-param-by-csrf' into 4.0-trunk