[dist] enable webui tests in spec file
[webui] Reintroduce CSRF protection for the webui. AUA!