Use POST for user actions, with a CSRF token

Fixes #905