More authentication related changes.

* checks for `XSRF-TOKEN` in the request header for authenticated actions.
* more comments related to handling user tokens.