* CSRF removed.  The worst thing a CSRF attack would ever do is submit a POST to the add event API.
* no more sessions in bookmarklet
Merge pull request #182 from OAButton/features/cookieless

Features/cookieless