Add CSRF protection

This requires that all effectful requests be done via ajax, which I
think is already true. If we wish to support normal forms, that is
possible, but will require slightly more work.

The "light" base template is not quite as light as before. Oh well.
'in' is not what I meant here
Do admin searches as GETs
Clean up dead JS
Merge pull request #247 from eve-val/csrf-protection

Csrf protection (fixes #92)
Add @authenticate decorator for detecting if a user is logged in, and throwing an HTTP 401 if they are not.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Add ability for applications to have different grant expiration times.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Add UI support for the new custom application expire times.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Merge pull request #260 from Acidity/feature/authenticated

Add authenticate decorator for detecting if a user is logged in, and...
Rename expireGrantTime to better reflect what it does.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Merge pull request #261 from Acidity/feature/customAppExpire

Add ability for applications to have different grant expiration times.
Fix a bug that prevented the deletion of groups.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Merge pull request #262 from Acidity/feature/fixGroupDelete

Fix bug that prevented the deletion of groups.