Method to get the token

The token will be generated if it doesn't exist.
Include the token in the url
Added a method that will check the token.

If the token is invalid we will just stop the script.
Check the token for actions that are based on add/edit/delete
Grab the token from the session.

Otherwise the token will be different each request, will render each
action useless.
Updated changelog
Remove the csfr-token from the session
It is CSRF (Cross Site Request Forgery), not CSFR
Unset correct var
Do not return anything because it is misleading
No need to check this on add/edit, because there is alread CSRF-checking in the form.
Don't store the token in a static var, just read it from the session.
Clear the token when the token doesn't match anymore.
Use a Response-object
Show an error

Instead of showing a blank page we will show an error. With this error the user
will be informed and can try to execute the action again.
Merge branch 'master' into csfr

Conflicts:
	CHANGELOG.md