WebPage: Force implementors to use anti-CSRF mechanism
- Introduce a parameter boolean mayWrite to WebPage.make(). Pages are required to only change the server state if this is true.
- That boolean is set to true by WebInterfaceToadlet if we are safe from CSRF: The request has been validated to be POST and the anti-CSRF token has been checked.
- As the interface of WebPage.make() has changed, the existing pages won't compile anymore. This is intentional: It forces a review of them to ensure that they are CSRF-safe.