Starting the long rewriting process.

Flush the whole main code and add new validation
code in.

ZCR actually prevents resending and CSRF only once,
after it will send the form as usual, since it assigns
new token to the form. As new token is assigned,
resending is possible by resending the form once again.

We basically are probably going to change the validation
to strict, but longer timeout. Unless we really want
to reassign tokens like that.