Added some security middleware from helmet().
Added level-session-csrf for csrf token support. Decorated all forms with tokens;
spot-checked a bunch of them but not all yet.
Started implementing support for gravatar avatars & for avatar.io avatars;
this is incomplete.