luci-base: add support for POST-only actions with CSRF token check