Updates for CSRF protection

The session itself is already secured (via an HMAC). We can just store a random token and check that the token is present and correct in the POST parameters.

Can add a check against something like `request.headers['X-CSRF-Token']` for easier AJAX as well.