Abort validation when the token validation fails

Issue Summary

Right now, there are two unsafe places to take actions (form builder, form validate handler) and one safe place (form submit handler). If we would abort the rest of the form validation after the token validation fails, we would automatically protect our validation handlers from CSRF as well, and we'd have TWO safe places, one unsafe.

The arguments for continuing validation are not strong; we can show errors on more fields. Okay, but the user will not be able to submit anyway, as the token is incorrect.