Renames 'session' to 'sqlsession'

So as to not conflict with Flask's 'session' global.
CSRF protection

Only for POST requests! The 'edit_poster' view accepts action over GET,
which is a problem. Unfortunately, the impossibility to nest forms
prevents me from doing it over POST.