Security fixes

Fixes some quite serious security faults with delayed_job_web:

* SQL injection attack via `?queues` parameter
* Destructive actions via GET (they're now POST)
* CSRF protection for destructive actions
* Adds Rack::Protection (via an updated Sinatra)

Without these changes, someone could quite easily drop your entire DB via an image tag.