Updates:

* CSRF prevention
* moved user to helpers package
* changed templates to use context variables
* GetContext() takes a sessions.Store object and a *http.Request