fixes csrf with mediauploader.ashx
Merge remote-tracking branch 'origin/6.2.1' into HEAD