Add CSRF protection

This requires that all effectful requests be done via ajax, which I
think is already true. If we wish to support normal forms, that is
possible, but will require slightly more work.

The "light" base template is not quite as light as before. Oh well.
'in' is not what I meant here
Do admin searches as GETs
Clean up dead JS
Merge pull request #247 from eve-val/csrf-protection

Csrf protection (fixes #92)