Replace the static nonce list with a session-bound nonce queue, move form keys from static to session. Prep for button conversion to POST related changes to follow