add the 'token-' prefix to all token keys

Up until now, the server side added the prefix. In order to prepare
support for optional tokens, this is now done by the client.
add opt-tokens to form if token is optional

opt-tokens always have the form %opt-token-keyword (where keyword is the
token keyword) and will be replaced by ''