MDL-48019 mod_forum: Add sesskey checks when setting tracking prefs

This also removes set_url() and changes require_course_login to
require_login as guests cannot set tracking.