Add CSRF protection to every form that changes data.

The logout link carries the token too, and the cookies get SameSite=Lax.

publish/login.php

@@ -9,6 +9,8 @@ if (isset($_SESSION['editor'])) {
   session_write_close();
   header("Location: https://xxx.org.za/publish/edit");
   return;
+} else if (isset($_POST['login']) && !csrf_valid()) {
+  $denied = TRUE;
 } else if (isset($_POST['login'])) {
   include_once('../open_db.lib.php');
   $table = "editors";
@@ -80,6 +82,7 @@ if ($denied)
 ?>
 
 <form action="<?php echo form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']); ?>" method="post">
+  <?= csrf_field() ?>
   <div class="grid">
 
     <label for="username">Username: </label>