[#61178164] Require csrf token when using session validation

 - csrf token is required for non get requests when using session based authentication
 - csrf token is not required for api key based authentication
 - if an api key is provided, authenticate only with the api key ignoring any session provided
[#61178052] Mitigates xss vulnerability in comments.

 - Comments are displayed as safe html, but the content was not being sanitized by the server
 - Now the server sanitizes comments on creation and on presentation.
[#61178164] posts going thorugh $.fileDownload need csrf tokens

 - Since $.fileDownload goes through form submission rather than ajax, we need append the csrf token
 - Proxy $.fileDownload via chorus.fileDownload and mixin the csrf token
[#61821894] Refresh csrf token on log out

 - Update the csrf token after destroying the session on logout.
 - Allows log in without refreshing the page
[#61821894] Update api doc to match logout's 200 response code
Enables request forgery_protection for integration specs.
[Fixes #61750650] Fixes workspace cannot be archived

 - An issue of 'true'/'false' vs true/false
 - Add an archived boolean column to the workspace model to treat it naturally as a boolean
 rather than shiming the accessors and checking string equality
[#61946884] Updates rspec_api_documentation to include authentication with session_id
Service pack 3.0.3.0