added CSRF protection for CMSimple_XH >= 1.6

Protects all back-end forms against CSRF attacks (the standard forms, i.e. config, language, stylesheet, are already protected by the core), if $_XH_csrfProtection is available (since CMSimple_XH 1.6). Publishing and unpublishing of entries would have to be rewritten as POST requests (what would be [reasonable anyway](http://tools.ietf.org/html/rfc2616#section-9.1)) to be able to use the [published XH_CSRFProtection API](http://www.cmsimple-xh.org/dev-doc/php/XH/tutorial_XH_CSRFProtection.cls.html).