Saas relder csrf delete file

A bit of refactoring to build CSRF verification into all routes in /rest/media.  To my knowledge, we're only using session based authentication in the delete and upload routes currently (there are a number of others).

I also added a prefix of baseUrl to the url because our other branch adds baseDir for this API call.  I'm not sure if baseUrl and baseDir are interchangable, but baseDir is not defined here.  Tested with deletion and it works.