Revamp session handling

* Don't save empty sessions

  + in particular, don't open unnecessary sessions triggered by crawlers

* Keep `session.id` when a session expires or has invalid hash

  + mark session as invalid in this case

  + ignore `user.name` of invalid sessions

  + increase `max_age` of session cookie to 1<<31

* Don't change `session.id` on login or change of password

* Use `uuid4` for `session.id` instead of `randrange (big number)`

* Add `request.path` to `Anti_CSRF.secrets`
Add CSRF protection to MF3 forms