Change the my_post_key regularly

[effone]

Quote from pre-PR:

MyBB uses "my_post_key" to prevent forged requests. Ideally this token should be unique for each request, or unique for each session (see on wikipedia) but in MyBB, the token never changes, ever.
At the same time it's easy for the my_post_key to be leaked. It's not only used in page sourcecode, as a hidden form input field, but also openly in links (Mark Forums Read, Star Rating, etc.) so a simple Copy & Paste operation may inadvertently include it, it's in the browser history, etc.
So here is an attempt to change the my_post_key regularly.
It adds a time-based element to the hash, causing a new code to be generated every 3 hours. By generating older codes in the verification step (It's an older code, sir, but it checks out...) each code may be valid for up to 12 hours. After that, the code is useless.
In terms of usability, this means if you send a post request with a tab that had been open for half a day, it will no longer work since the my_post_key of the old tab had already expired. You have to reload to get a new key.

PR for this:
#3374

[Azareal]

SameSite cookies can probably mitigate this issue to some extent, although they're not available on mobile and older browsers, so it's good to have extra layers in.

[euantorano]

Note: This change should be mentioned in the release post in case there are any plugins checking the post code manually.