As I was debugging my changes to add redis support for session and otks
databases, I noticed that the issue.search page does not request a CSRF token.

It also uses GET for it's submission mode.

This makes sense in most cases as it doesn't change any issue data. However
because we name the search and save it to the search list, it does modify data.

So this should have CSRF protection if the change is to be saved/committed.

I think this is a low priority. I am not sure how it could be used to do much
of anything other than mess with a user's searches. Using GET for searches (so we
can bookmark and share them) already provides the same exposure this does to issue
data.

changeset:   8835:0329eca46211 added to make search action
require POST method be used.

Also changes to all templates that have forms using
search action.

added changeset:   8836:c405d557758e
to fix broken test and add new test verifying GET returns error.