Gui 427

Biggest things here;
- setup generic handling of file download and applied it to all user functions that cause a download
- added csrf checks to all XRF calls in user