Security fixes to how discussions are posted and edited

* Closes CSRF vector in /post/discussion & /post/editdiscussion.
* Disallows changing the Format of a discussion when it shouldn't be.
* Disallow blank Format values; it is going to continue to be a security target otherwise.
This looks like you're disallowing the format to remain the same on edit unless it is explicitly passed. I'd prefer edits just keep the same format.