Reworked csrf tokens, now enabled globally
The way this now works is, if csrf is enabled:
 * Any new or existing template can have csrf protection by adding the hidden input ctoken that's in this batch to its form, removes any logic in templates
 * Page controllers that already exist have been updated, new ones only require checking if csrf is enabled and valid
Token failure condition fix
cleaned up tabbing and sessions in index
fixes bug in registration form, thanks @Zen00
Merge pull request #1576 from xisi/csrf-backend-only

[FIXES] More CSRF improvements