[FIX] Tokens: Return the csrf token and request correct site

This fixes two major problems:
- When a token with the old name is requested (e.g. 'edit') it
  uses the new 'csrf' token instead and saves it as an 'csrf' token
  in the cache. So the request afterwards must return the 'csrf'
  and not 'edit' token (which doesn't exist)
- It must request with the current site and not the default site,
  otherwise the default site might return an invalid token or will
  emit warnings because it doesn't understand the new API (and the
  version check was with the intended and not the default site)

Instead of a warning, it only returns '+\' if the user has not enough
rights with the new token system, so this is dropping all tokens
which only consist of those two letters.

Bug: 70760
Bug: 70766
Change-Id: I38e326c0f5382a585fba11bc6cbfba1a3dffaca5
Merge "[FIX] Tokens: Return the csrf token and request correct site"