require post method and token for some actions
cache: use timeout while locking
added csrf protection
store token in var folder
csrf implies required post
make standard command csrf safe