classic-ui: Fix CSRF protection in cmd.cgi matches only complied in URL #6459

fixed and tested. also visibl in config.cgi now.

refs: #6459