session: Send session token with any POST requests

The nature of non-api POST requests, and how they don't carry any account data to make sure that the user submitting the information has actually submitted the post request from the application, could cause some issues and enable the ability for exploits from third-party sites.

This could be exploited by people tricking people into sending POST requests over while they are logged in, causing damage to their accounts.

So, now, any `login_required` non-api post requests require a token to be sent with them, which is compared with the session challenge, to make sure we're talking to the correct person.

This will not have any effect on the API because we already know we're talking to someone with the API key.