Action token requests

Various requests should require an action token

Ideally they would POST too, but in the absence of that we should add action token verification to them.