Settings: New Site.csrfExpires setting

End users can now configure their token expiry policy as needed.
Closes #344