[FIXES] CSRF tokens & login cleanup

 * Now checks if a minute or hour rolled over, much more permissive by default
 * Much less prone to catching people at leadtime+1 seconds ahead of the minute, so less hits overall
 * Removes config option for csrf.options.sitewide, no longer used
 * Cleans up login page logic