Require nonce/POST for de/activating plugin

Fixes a vulnerability where a CSRF attack could disable the plugin.
Ignore PHPStorm directory