Add SECURITY_TOKEN to forms and bump the WCF minimum version
see WoltLab/WCF@77329f8