Security fixes to how discussions are posted and edited

* Closes CSRF vector in /post/discussion & /post/editdiscussion.
* Disallows changing the Format of a discussion when it shouldn't be.
* Disallow blank Format values; it is going to continue to be a security target otherwise.
No, I was just going for the closest FormatMethod to 'Raw' which is basically what it was. I'm fine with removing this entirely and going with Text if you don't think it will cause a problem.