Add CSRF tokens on appearance, settings, security
Expand disallowed PHP files in .htaccess
Add CSRF protection on themes actions.
Add CSRF protection for navigation.
Fix ThemesController test.