More authentication related changes.

- checks for XSRF-TOKEN in the request header for authenticated actions.

-more comments related to handling user tokens.