Security fixes to how discussions are posted and edited

* Closes CSRF vector in /post/discussion & /post/editdiscussion.
* Disallows changing the Format of a discussion when it shouldn't be.
* Disallow blank Format values; it is going to continue to be a security target otherwise.
I'd prefer the unset on update. It's the most robust and api friendly.