allow csrf to be ignored (set to blank); for use in some distributed server situations
hard-coding topic urls to start with /topics
Merge branch 'performance' of git://github.com/bcipolli/ka-lite into performance
Re-enabled CSRF, but read token from cookie so it isn't always generated.