server (pages): impleted CSRF protection: A basic CSRF protection has been implemented using CSRF token. The token is created on session creation, and checked on data post. The process should be fully automatic, and a hidden field is added in forms in sat_templates when csrf_token is present in template data (require to import input/form.html with context). If token is wrong on absent, an unauthorized error page is returned (and client ip is logged). Also don't use anymore inlineCallbacks in _on_data_post, as StopIteration exception are catched by inlineCallbacks, resulting in bad behaviour. As a further security, getPostedDate raise a KeyError instead of StopIteration is a specific key is looked for and missing. Added HTTP_SEE_OTHER status code in constants.

--- a/src/server/constants.py	Sun Jul 09 22:28:40 2017 +0200
+++ b/src/server/constants.py	Mon Jul 10 19:10:31 2017 +0200
@@ -63,6 +63,7 @@
     HTTP_METHOD_POST = u'POST'
 
     ## HTTP codes ##
+    HTTP_SEE_OTHER = 303
     HTTP_BAD_REQUEST = 400
     HTTP_UNAUTHORIZED = 401
     HTTP_NOT_FOUND = 404