added csrf token middleware and fixed the most obvious forms and form code. further testing still required
more csrf token changes
added bleach attributes setting
two missing csrf tokens added
Merge pull request #314 from grischa/csrf

adds CSRF protection to everything but uploads