Sanitize user input and move from GET to POST

Almost all important (and not using redirects) actions are now
performed using POST rather than GET requests.  This will make
CSRF protection much easier in the future.

Validation has also been added through the express-validator
package, to sanitize some inputs.

Jira issue: WP-781
Include anti-CSRF middleware in PZH Web Server

The PZH Web Server was horribly vulnerable to CSRF attacks, particularly
as it offers so many powerful POST interfaces and relies on a single
log-in system.

This commit fixes the problem by using the connect csrf middleware, and
refactoring a lot of the code to be two-stage rather than one-stage
events.

In addition, the main page has been refactored into a number of templates
for ease of use, and to enhance readability.

Jira issue: WP-781
Add CSP headers and HSTS support

The PZH Web Server now implements a weak CSP policy (defined in
config.json) and supports HSTS headers.

Jira issue: WP-731
Merge pull request #5 from jplyle/csrf-prevention

Protection against CSRF attacks on the PZH Web Server