[FIXES] CSRF tokens & login cleanup

 * Now checks if a minute or hour rolled over, much more permissive by default
 * Much less prone to catching people at leadtime+1 seconds ahead of the minute, so less hits overall
 * Removes config option for leadtime as it's no longer used
 * Fixes use of an old config option
 * Cleans up login page logic