[FIXES] More CSRF improvements

 * Any new or existing template can add protection by adding the hidden input ctoken that's in this batch to the form
 * Removes all config checking logic from the templates
 * Pages that already exist have been updated
 * New pages only require checking if the config option is enabled and token is valid
 * Anywhere it's not checked will not be affected by these changes

I haven't tested this in every single spot that it's used yet - there may be an instance or two where the page changes on form submission which would invalidate the token, but overall a big improvement.

Thanks @neozonz for asking about this :+1: