menu: add anticsrf-token to links

"Protected pages" will force a re-Auth if the session has expired. Since
this causes a redirect in simplesamlphp, the antiCSRF-token is not
properly propagated in the redirect-url, causing Confusa to complain
when being redirected back to the idp_select page.

This adds an antiCSRF-tag to all protected URLs in the menu.

Signed-off-by: Henrik Austad <henrik@austad.us>