Added XSS, CSRF protection

Also added a CSRF-protected, admin-only 'x' button
to delete users in about.jspf