Security: CSRF prevention

Prevent Cross-site request forgery style attacks.

* Require valid client token when performing actions via web GUI
* Restrict http methods used for certain actions
* Disallow access to the API via web GUI

This branch builds on #908