Moved csrftoken stuff into a class
added getCurrentIP method to user class
added config option for sitewide csrf protection