fix the getUrlForExtraId function
allow blocks to have an edit_url as data too.

If a block has an edit_url in it's data, it will be now used.
add anchor to url
add anchor to action via action file
Removed "Thx to XYZ from CHANGELOG.md"

* Changelog is for announcing changes
* Attributions are in git log, or even at https://github.com/forkcms/forkcms/contributors
* The most active contributors were not even mentionned
remove references and comments copied from the blog module
Method to get the token

The token will be generated if it doesn't exist.
Include the token in the url
Added a method that will check the token.

If the token is invalid we will just stop the script.
Check the token for actions that are based on add/edit/delete
Grab the token from the session.

Otherwise the token will be different each request, will render each
action useless.
Updated changelog
Remove the csfr-token from the session
Bugfix: escape input before appending it directly in the jQuery plugins.

At first this looks like XSS, but it isn't. The plugins (multitext, tags,
key/value, ...) were just using the raw input for building their elementlist.

If you entered XSS-like text it was just handled as HTML and append, and
therefore it look like it was XSS. But when it was saved to the database
Spoon handled the raw HTML correctly and escaped all special chars.

When the form was shown again the plugin builds the list again, and thus made
appended it directly and executed the XSS.
Updated changelog
Merge pull request #466 from WouterSioen/faq-comments2

remove references and comments copied from the blog module
Merge pull request #462 from matthiasmullie/master

Removed "Thx to XYZ from CHANGELOG.md"
It is CSRF (Cross Site Request Forgery), not CSFR
Unset correct var
Do not return anything because it is misleading