frontend: proper CSRF protection

Currently the CSRF protection is pointless.
Tokens should be generated per session.
And once lustre actually supports it ?csrf-token=" <> csrf_token in webserver.serve_html should be replaced with the token in a meta tag.
As shown in the example