Add CSRF protection to every form that changes data.

The logout link carries the token too, and the cookies get SameSite=Lax.

publish/index.php

@@ -64,6 +64,12 @@ if (isset($_POST['action']))
 else
   $action = NULL;
 
+// A POST without a valid CSRF token only gets a preview
+if ($action && !csrf_valid()) {
+  $validate['csrf'] = 'Your session has expired. Please check your story, then send it again.';
+  $action = 'preview';
+}
+
 switch ($action) {
   case 'post':      // post to database
   case 'save':    // post to queue