Csrf protection (fixes #92)

This requires that all effectful requests be done via ajax, which I
think is already true. If we wish to support normal forms, that is
possible, but will require slightly more work.

The "light" base template is not quite as light as before. Oh well.
*handwave* the paper's authors said so *handwave*

references for reading:
http://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader%28%29-method
http://www.w3.org/TR/cors/#resource-preflight-requests
https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

I haven't actually spent the time to sift through and grok these yet, this is as much a note to myself as anything.