[FIX] CSRF protection for admin settings/user/news

thx @xisi