- Store form handler nonces in the servlet session instead of system properties, to prevent cross-session interference
- Consolidate all the jsp formhandler boilerplate in the new formhandler.jsi, in preparation for further improvements