Csrf protection (fixes #92)

This requires that all effectful requests be done via ajax, which I
think is already true. If we wish to support normal forms, that is
possible, but will require slightly more work.

The "light" base template is not quite as light as before. Oh well.
Which browsers does this apply to? All of them? Is this in the HTTP spec or do we need to limit the browsers we accept as valid for Core?