More authentication related changes.

- checks for XSRF-TOKEN in the request header for authenticated actions.

-more comments related to handling user tokens.
Fixed typo in comments.
Merge pull request #13 from nloyola/master

More authentication related changes.