[ADDED] Simple CSRF protection tokens
 * Adds config options for disabling, timeout lead time, and forms
 * Adds another salt in config that's used in the token
 * Adds protection for login form by default