This simplifies the code, and lets us set the CSRF cookie as HttpOnly, which
adds a little bit of security.
(imported from commit 9d5923a1acf19bd27e6e1d55cf627049526de245)
Known issues:
* Not all of the options in the menu are functional yet
* The wording isn't totally perfect on some of these options;
I kind of want to use a 'first name' in some of them.
(imported from commit 5a333fb939fcca7e0d0ecb2c43e79501139ac0db)
