Protect againts cross-site request forgery attacks by requiring a special
form-field or header to be sent with requests that modify ticket system
data.

This meant a slight change to the AJAX ticket locking mechanism. It was
defined to lock with a GET request; however, GET requests are defined as
safe methods and should not modify backend data (such as a lock
acquisition). Therefore, the the lock acquire AJAX method was changed to
require a POST method.

Also remove old, no-longer-used staff panel include files

Most things work, still outstanding
  - the table needs to support filtering like the graphs,
  - the bootstrap.css file needs to be culled of what isn't used for now,
  - g.raphael needs to be re-minned after a issue is filed with g.raphael
    for the snapEnds() function not picking reasonable graph axes.
  - split dashboard.php into several smaller js, css, etc., respective files

Add support for aggregating data together and encoding it according to the
report AJAX specification for the reporting front end.