CSRF vulnerability

Currently, CSRF attacks are quite easy to do on Hilary, even with secure browsers.

```html
<html>
  <head>
    <title>You stink!</title>
  </head>
  <body>
    <form method='post' action='http://oae.oae-performance.sakaiproject.org/api/auth/logout'>
      <input type='submit' value='Do not log me out' />
    </form>
  </body>
</html>
```

Store that locally and post the action host to your instance, and you can log yourself out. This can be done with any other post action.

The ServerProtectionService in Nakamura checked the referrer to ensure to ensure that it comes from the same host. We should use this as well to protect against this kind of attack.