fix the getUrlForExtraId function
allow blocks to have an edit_url as data too.

If a block has an edit_url in it's data, it will be now used.
add anchor to url
add anchor to action via action file
Method to get the token

The token will be generated if it doesn't exist.
Include the token in the url
Added a method that will check the token.

If the token is invalid we will just stop the script.
Check the token for actions that are based on add/edit/delete
Grab the token from the session.

Otherwise the token will be different each request, will render each
action useless.
Updated changelog
Remove the csfr-token from the session
Bugfix: escape input before appending it directly in the jQuery plugins.

At first this looks like XSS, but it isn't. The plugins (multitext, tags,
key/value, ...) were just using the raw input for building their elementlist.

If you entered XSS-like text it was just handled as HTML and append, and
therefore it look like it was XSS. But when it was saved to the database
Spoon handled the raw HTML correctly and escaped all special chars.

When the form was shown again the plugin builds the list again, and thus made
appended it directly and executed the XSS.
Updated changelog
It is CSRF (Cross Site Request Forgery), not CSFR
Unset correct var
Do not return anything because it is misleading
No need to check this on add/edit, because there is alread CSRF-checking in the form.
Don't store the token in a static var, just read it from the session.
Clear the token when the token doesn't match anymore.
Use a Response-object