Security fixes to how discussions are posted and edited

* Closes CSRF vector in /post/discussion & /post/editdiscussion.
* Disallows changing the Format of a discussion when it shouldn't be.
* Disallow blank Format values; it is going to continue to be a security target otherwise.
Looking at the logic below a blank format will just be formatted as text. Is this really necessary?