CSRF protection support

- automatically add csrf_token to all forms created with form_for
- new postlink command to create links with data-method post and
  csrf_token
automatic CSRF protection of all non-GET routes
form_for needs to be from $self
replace all manual data-method links with helper
fix undefined use of Scheduler
verify job is set
provide CSRF token to javascript via meta tag
fix absolute path logic
add authenticate command to api to provide CSRF token