ref(controller): remove csrf token; switch to token-based authn

With this PR, CSRF tokens are no longer necessary to make API requests with the server. To facilitate that, we needed to shift over to Token-based authentication so that we are not vulnerable to these attacks. Had we kept session-based authentication, we'd be vulnerable as attackers can easily `<iframe>` a site that utilizes the API (such as a web console), generate a POST request and re-use the existing cookie. Using token-based authentication fixes this because there will be no existing auth cookie in the request.

With this change, we are also not vulnerable to XSRF attacks either because we do not store a validated login cookie in the browser (yay!).

fixes #1488
> This may no longer be necessary.

`DisableCSRF` is still in here--was it needed after all?