Make the XSRF token live for as long as the session, remove some old array handling code. Closes #2174