default features - actually handle the security token in the addon code

I was depending on the token created in and passed from mod/admin.php before, which wasn't smart, and apparently meant the security token might show up or not depending on the order in which parts of the template were processed. Hopefully this actually works for others now.