NEW: Allow form submission when tokens are disabled

If Security tokens are disabled user forms will never reach the finished method as it checks for a session variable of FormProcessed which is only set from the security token.
This patch adds extra checks to see if security tokens are disabled and sets FormProcessed with a random hash which is then confirmed in the finished method.

Tested this by extending UserDefinedForm and calling $form->disableSecurityToken to disable the tokens, to confirm the form can still be submitted.