CVE-2013-5954: Fixed CSRF vulnerabilities

Multiple scripts were performing actions upon GET calls without any
protection from CSRF attacks. Under certain circumstances, that could
allow attackers to delete entities on a Revive Adserver instance.

Forms using POST had been fixed already.
Added comment to explain the token behavoiur on form validation errors
Removed extra (empty) GET parameter in admin user links
Fixed potential SQL injection vector

This can't be exploited using the standard delivery log plugin, but it
could be using delivery log plugins that accept strings provided by the
browser.
CVE-2013-5954: Added release notes for changes.
Added release date
3.0.5
Merge branch 'REL_3.0.5'

Conflicts:
	constants.php
Bumped version for the next release