CSRF/XSS changes to 2.6.x

Added secure.token service