Remove the wrong zero-max-age on form tokens, but still handle BC through opt-in