Fix CSRF exposure
Fix upvolt route to not expect a document
Update only the count span when setting upvolt counts
Css and parenting tweaks