Authenticity token

This implements #893 using a slightly modified version of rack-protection.

Please do not merge as long as the associated pull request is closed. If it is not accepted, the change can cleanly ported by ourselves.