More correct usage of HTTP verbs

Most notably, don't allow GETs on unsafe methods
Use ExtJS jQuery adapter instead of ext-base

Now that we're finally using jQuery, the adapter makes a lot of things
easier. For example, you can set global jQuery Ajax event handlers that
will run even if you use Ext.Ajax.request.
CSRF prevention

This upgrades to Spring Security 3.2 RC1. Yes, it's a release candidate,
but the API is pretty stable, and it's the only way to get native CSRF
token support.

Note that X-Frame-Options is set to DENY by default. If you're using
OpenEssence in a frame, you'll have to do some (small) tweaks.
Disable CSRF tokens for API clients

As a compromise, API clients must set their User-Agent to be
`openessence-api-client`.
Merge pull request #23 from gabegorelick/csrf

CSRF prevention