FIX: XSRF handling for esp-html-mvc

Only generate security tokens in views.
Check only if not a GET request.
FIX: add missing uninstall script to binary install.