Add a feature to prevent duplicate POSTs

This patch adds an activity token to the page (if the `<?php activity_token(); ?>` is added to a PHP template inside of a form with method="post"). When the request is sent to the server, the server will confirm the current activity token in the user's session with the activity token sent in the request. If they match, then the request represents new activity. If they do not match, the request is likely a repeat.

The token is rolled each time it is checked, regardless if the activity token represents new or repeat activity.