Add general method for using session CSRF token.
Add CSRF protection for files, items, collections
Add CSRF protection to plugins actions.
Kill notice in ElementForm on incomplete POSTs.
Use "token" instead of "hash"
Fix display of Csrf quasi-form
Fix tests for now-protected forms