Security tweaks, mainly adding csrf checks

Fixes #245 and should only affect html forms.  Also shortened tokens and
added nonces to token auths.