Introduce tokens by default in forms

Just ran this through its paces on a fresh install. Some forms, like poll.module's voting, aren't fully FAPI-ified and thus are unaffected by this security check. Others, like commenting and node creation, properly throw a validation error when submitting a form with a tainted or missing token.

This is a big patch, any other reviews? Anything different from the 4.7 version?

I'm not sure if this is a security issue, but it is relatively easy to get to know the 'drupal_private_key':

The token (which is publicly shown in every form) is calculated with this function:

function drupal_get_token($value = '') {
  $private_key = drupal_get_private_key();
  return md5(session_id() . $value . $private_key);

The session_id is know to the user, $value is the forum_id.
$private_key is the only unknown part.
And since $private_key = mt_rand() (a number between 0 and 2147483647 on my machine) it is relatively easy to get to know the drupal_private_key.

(it costed me less then 40 minutes to find 2 different drupal_private_keys)

Apart from that, this patch seems to be working on head.

note: that should be "$value is the form_id" of course.

We should put the issue about the 'drupal_private_key' in a seperate issue. I'll open one, and attach a patch.

Been using this patch on my site for a few days now and haven't had any troubles yet.

Committed to HEAD>