[mms] SECURITY: Fix token validation of AJAX actions.

Mea culpa.  This commit broke things:

commit 83dcfa1448ba2b142623839aee78a2160eb25cb0
Author: Michael M Slusarz <slusarz@horde.org>
Date:   Wed Oct 17 13:27:10 2012 -0600

    [mms] Allow AJAX handler methods to be marked externally accessible
    (i.e. no session token checking) (Bug #11538).

This commit failed to extend the injector to pass the token argument to
the AJAX Application handler.  Although we should always do this check,
regardless of whether the token is empty anyway.
Fix XSS on SmartMobile portal

Signed-off-by: Michael M Slusarz <slusarz@horde.org>
[mms] SECURITY: Fix XSS vulnerability on smartmobile portal page (João Machado <geral@jpaulo.eu>).
Better way of iterating through rulesets