Customizer: Refresh nonces when a session expires and the user logs in again.

This was broken since 4.0 and the introduction of user session tokens. The nonces are now tied to session tokens as opposed to user IDs, and thus they change with each re-login.
Custom nonces can be added through the `customize_refresh_nonces` filter. On a successful refresh request the JavaScript API will trigger a `nonce-refresh` event. See widget's update nonce as an example.

props westonruter for initial patch.
fixes #31294.

git-svn-id: https://develop.svn.wordpress.org/trunk@32054 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/class-wp-customize-widgets.php

@@ -95,6 +95,7 @@ final class WP_Customize_Widgets {
 		add_action( 'customize_controls_print_footer_scripts', array( $this, 'print_footer_scripts' ) );
 		add_action( 'customize_controls_print_footer_scripts', array( $this, 'output_widget_control_templates' ) );
 		add_action( 'customize_preview_init',                  array( $this, 'customize_preview_init' ) );
+		add_filter( 'customize_refresh_nonces',                array( $this, 'refresh_nonces' ) );
 
 		add_action( 'dynamic_sidebar',                         array( $this, 'tally_rendered_widgets' ) );
 		add_filter( 'is_active_sidebar',                       array( $this, 'tally_sidebars_via_is_active_sidebar_calls' ), 10, 2 );
@@ -888,6 +889,20 @@ final class WP_Customize_Widgets {
 		add_action( 'wp_footer',          array( $this, 'export_preview_data' ), 20 );
 	}
 
+	/**
+	 * Refresh nonce for widget updates.
+	 *
+	 * @since 4.2.0
+	 * @access public
+	 *
+	 * @param  array $nonces Array of nonces.
+	 * @return array $nonces Array of nonces.
+	 */
+	public function refresh_nonces( $nonces ) {
+		$nonces['update-widget'] = wp_create_nonce( 'update-widget' );
+		return $nonces;
+	}
+
 	/**
 	 * When previewing, make sure the proper previewing widgets are used.
 	 *