patch csrf token generation [bugid:4235]

let the csrf token persist across all user sessions in a single browser (and expire it when the browser closes).
shouldn't be a security risk and should eliminate a lot of stale-browser-window authenticity token issues.
Friendly ActiveRecord error handling for db-enforced unique constraints
unicode patch for Rails escape_javascript

use actual javascript unicode escapes.
tested in osx safari 5/ff3.6/chrome9 and winxp ie7/ie8
per info on:
https://developer.mozilla.org/en/Core_JavaScript_1.5_Guide/Core_Language_Features#Unicode
and looking at:
http://code.google.com/apis/opensocial/docs/0.8/reference/gadgets/#gadgets.util.escapeString
lower template logging to debug
[bugid:18984] remove yaml-ization in Active Resource