Security fixes to how discussions are posted and edited

Updated 19 Dec.

* Closes CSRF vector in /post/discussion & /post/editdiscussion.
* Disallows changing the Format of a discussion when ForceInputFormatter is set.
* Blank FormatMethod now defaults to Text, a much safer fallback.