XML api was broken by CSRF.

It uses a req.body STREAM to read XML. But the addition of express.urlencoded() body parser caused the body to already have been read and "parsed" into "json".

Fix by manually declaring the paths which require urlencoded bodies to get read.
Fix admin not being able to lower legacyagelimit
Calculate classification.agelimit from criterias
Search by agelimit

Applies to current agelimit if no classifier/date is queried.
If a classifier or date is in the query, applies to a classification matching those limits.
Search by warning icons

All selected warnings must be in the classification.

Applies to current active classification if no classifier/date is queried.
If a classifier or date is in the query, applies to a classification matching those limits.