fix: set token in forms correctly

We now use the hash of the token for comparison and as the id. In order to use it you need the original token though. So forms and thus the session should have token.to_s rather than token.id.

fixes #8784 (closed)