fix the getUrlForExtraId function
allow blocks to have an edit_url as data too.

If a block has an edit_url in it's data, it will be now used.
add anchor to url
add anchor to action via action file
Method to get the token

The token will be generated if it doesn't exist.
Include the token in the url
Added a method that will check the token.

If the token is invalid we will just stop the script.
Check the token for actions that are based on add/edit/delete
Grab the token from the session.

Otherwise the token will be different each request, will render each
action useless.
Updated changelog
Remove the csfr-token from the session
Bugfix: escape input before appending it directly in the jQuery plugins.

At first this looks like XSS, but it isn't. The plugins (multitext, tags,
key/value, ...) were just using the raw input for building their elementlist.

If you entered XSS-like text it was just handled as HTML and append, and
therefore it look like it was XSS. But when it was saved to the database
Spoon handled the raw HTML correctly and escaped all special chars.

When the form was shown again the plugin builds the list again, and thus made
appended it directly and executed the XSS.
Updated changelog
It is CSRF (Cross Site Request Forgery), not CSFR
Unset correct var
Do not return anything because it is misleading
make use of deleteThumbnails function in the blog module
Keep get parameters when rewriting backend url
Merge pull request #476 from DoFken/patch-11

Keep get parameters when rewriting backend url
Merge pull request #474 from guytarded/deleteThumbnails

make use of deleteThumbnails function in the blog module