added security action actions and annotations, and added SessionCsrfToken model which whould have been in last commit
moved favicon out of web controller so that SessiondAction is not called every time
added space before IP log in global controller