Fix you-are-logged-in logic
Nit: made setBothStatuses function clearer
Basic CSRF protection for /setup
Allow GCM endpoint to be configured at /setup