Merge pull request #5807 from cash/csrf_token

Fixes #4429 switches csrf token request to a GET from a POST
Merge pull request #5815 from cash/manifests_1.9

Updates manifests for 1.9
Improves API of elgg_format_element
Re-enforce in docs that menu item text is HTML (will not be escaped on output)
Doc fix
Moved options to 4th arg
Merge pull request #5820 from mrclay/format_element

Improves API of elgg_format_element
moved logic for preparing head variables into views library rather in a view - adds plugin hook
added deprecation for previous favicon view