Took the patch and adapted it to core. Both python 2 and 3 tests pass.
The original code wasn't catching exceptions that can come from 
somebody hacking the opaque token. I think I am catching them all now.

Make the hidden field name different from Erik's code so in theory
both can live together.

Added registration_delay option in [web] section of config.ini. If set
to 0 delay check is disabled. If set > 0 it is the number of seconds of 
delay. Default 4 seconds.

rev5973:fe334430ca07 for most of it with rev5974:98a8509ce45c