Prevent crossdomain attacks

[stefchri]

add token to session and check if this is the same as posted with each form.

1. Add session var TOKEN (randomly generated)
2. Add TOKEN to each form (same as in session)
3. Check if both are the same

[stefchri]

for next version