* Only pass the body of `POST` requests to `cgi.FieldStorage` if the request content type corresponds to a form submission.
* Only require the form token for `POST` requests with a content type corresponding to a form submission, fixing XML-RPC (#4122) etc. in a more generic fashion (compared to [4243]).
* The form token cookie is no longer persistent; it is now deleted when the browser session is closed/reset.
