WebSession: CSRF tokens in account settings forms

* Improves internal account settings edit page (`/youraccount/edit`)
  by generating unique CSRF tokens valid five minutes.  (closes #1855)

* Accepts only POST requests and verifies CSRF token expiry when
  performing desired settings change (`/youraccount/change`).

Reported-by: Bessem Amira <bessem.amira@cnudst.rnrt.tn>
Signed-off-by: Tibor Simko <tibor.simko@cern.ch>
Reviewed-by: Samuele Kaplun <samuele.kaplun@cern.ch>