Fix CSRF vulnerability of the admin interface.

- Require a secret token for every request.
- Token is regenerated at session start and login/logout
- Token not required for the user/rest interface, since auth data must be provided.
Cosmetics.
Document progress so far.