Add CSRF protection to all form posts

A cleaned up version of the CSRF protection that was originally included in #51.

This enables cookie-based sessions in the Sinatra app, but they're scoped to just the app using a unique cookie name.

Closes #54.