* CSRF removed.  The worst thing a CSRF attack would ever do is submit a POST to the add event API.
* no more sessions in bookmarklet