Add some missing VModhash checks.

This fixes nine XSRF vulnerabilities reported by Jordan Milne
(/u/largenocream).
Remove obsolete /api/frame and /api/noframe endpoints.

These endpoints don't appear to have been used since
reddit/reddit@a07c576d1a8a548d8b22516304c64152d5eb89a0 and I have
verified via haproxy logs that they are not ever being called.

This fixes two XSRF vulnerabilities reported by Jordan Milne
(/u/largenocream).
V*OrAdminSecret: check modhash if secret token not used.

It is necessary to do this check in V*OrAdminSecret as we cannot (and
should not) require a modhash when the secret token is being used
because this would break API compatibility and isn't necessary.

This fixes two XSRF vulnerabilities reported by Jordan Milne
(/u/largenocream).