4. Should be better now.
Tokens are now stored in file because session has a major problem, I've just discorered it now. I can share with you :
In PHP, when you store in $_SESSION var, it seems that the values is really stored (and available) only after the end of execution of the script who is involved for writing in this session. It is not possible to access a session var in the same time by another script, until the first one is finished.
It is maybe considerated as normal, but for tokens is it generating collisions.
So now it is handled by file, and for the moment I didn't encountered this problem again.
For your other problem, I am really sorry, but I cannot see that, and nobody is complaining about such issue.
So, I would prefer you open a new ticket for this particular problem (3.)
For the moment I close the ticket