Subscribe fixes

Some tidy up from the CSRF fixes plus fixes to the subscribe/unsubscribe mechanisms (button and checkbox).

Please review to ensure it makes sense, was unsure about the editlink needing a token.

Tested using the simple theme which includes 'hidden' css class.