More tokens

More csrf tokens for various forms in Airtime, including the multi-part file upload.  I was able to test all of these, but for the multi-part file upload I was never able to see the library enter the list of things in media.  I believe this is an unrelated problem because it seems to happen even without my code change.  The ajax requests for multi-part file upload appear to work (from what I can see in the network manager in chrome developer), but the files not appearing bug interferers with my ability to completely verify this bug fix.
This pattern looks useful. When we implement this for the other REST methods we should refactor this into two functions, one for adding the hidden CSRF form element to the page and one for verifying it. I'd like to see the verification function throw an exception instead too. (Perhaps the exception could be caught in init(), which would then call sendJson with the CSRF error.)