Added CSRF

Added the csurf middleware and implemented it in site.js. Created a
custom middleware that actually sets the csrf token to res.locals so
that it's visible in all views but also checks to see if the route being
passed through the middleware is an api route. If it's an api route,
csrf is not used. The external JS script (main.js) and all the views
with a post form were also edited to include a hidden input field that
holds the csrf token so that it can be sent back for validation.

closes #77