Protection using CSRF tokens.

see #240
Also protect the forward definition form.

see #240
Merge branch 'master' into csrf
Use DELETE method instead of GET.
New check.