adds CSRF protection to everything but uploads

please pull after the bleach pull request
uploads are fixed in the next pull request