[web] stop accepting the magic __message form parameter
This has been deprecated for a while, and replaced by _cwmsgid, which
doesn't allow arbitrary content.
if versions_map['cubicweb'][0] == (3, 7, 4):
config['http-session-time'] *= 60
config['cleanup-session-time'] *= 60
config['cleanup-anonymous-session-time'] *= 60