Improve CSRF handling

Author: mevdschee

api.php

@@ -2336,7 +2336,7 @@ public function executeCommand() {
 // 	'secret'=>'someVeryLongPassPhraseChangeMe',
 // ));
 // if ($auth->executeCommand()) exit(0);
-// if (empty($_SESSION['user']) || $_GET['csrf']!=$_SESSION['csrf']) {
+// if (empty($_SESSION['user']) || !$auth->hasValidCsrfToken()) {
 //	header('HTTP/1.0 401 Unauthorized');
 //	exit(0);
 // }
@@ -2347,7 +2347,7 @@ public function executeCommand() {
 // 	'authenticator'=>function($user,$pass){ $_SESSION['user']=($user=='admin' && $pass=='admin'); }
 // ));
 // if ($auth->executeCommand()) exit(0);
-// if (empty($_SESSION['user']) || $_GET['csrf']!=$_SESSION['csrf']) {
+// if (empty($_SESSION['user']) || !$auth->hasValidCsrfToken()) {
 //	header('HTTP/1.0 401 Unauthorized');
 //	exit(0);
 // }