Fix CSRF of the admin interface with HTTP/external auth.

Require both a token and a correct referer when trying to perform any action,
meaning another DL request must have been performed before even when HTTP auth
is in use. This makes CSRF possible only in combination with a local XSS.