Update token handling for core API change

Core change I2793a3f2 changes API handling in a way that needs updates
to extensions for proper operation:
* needsToken() now returns a string
* Most custom token types are being replaced with a 'csrf' token (the
  former 'edit' token); any others need a new hook.
* All tokens must use a static salt. Compat with web UI using non-static
  tokens is supported and also serves to handle the now-deprecated token
  fetching.
* Documentation in getParamDescription() should return a string (not
  array) for 'token', as the signal to core that it should be replaced
  with a standardized message.

When compatibility with earlier versions of MediaWiki is no longer
maintained, the entry for 'token' from getAllowedParams() and
getParamDescription() may be removed, as may getTokenSalt(). This patch
leaves them in place.

Note this is intended to be compatible with earlier versions of
MediaWiki, and so should be safe to merge before the core change.

Change-Id: I7b6f9b4cef7f50c2b0def30a06159bccc4d737f3