Log browser performance data to statsd.
Add aggregate perf timer for a fast average overview.
Fix some CSRFs
Allow ensuring controllers are explicit about CSRF prevention
Mark exempt endpoints and controllers as handling CSRF prevention
Do CSRF prevention checks at startup