REST: fix CSRF attacks when used in combination with HTTP authentication.

- Simply use a double-submit approach
- New clients will be able to work on any server/auth scheme
- Old clients will fail on new server (in theory we could have marginally
  avoided this by only requiring double-submit when using external auth as
  well, but a browser with previously-stored credentials would still be
  silently affected).