[webui] Reintroduce CSRF protection for the webui. AUA!

This should also go into master...