Uploads with progress and a restricted-access site

Uploads with a progress bar use XMLHttpRequest directly and did not receive the CSRF token: they came back 403 even with the user logged in. The global JavaScript now wraps same-origin write requests and adds the token when nobody set it.

In the same delivery, a development, staging or private installation can be closed to the public from the configuration or from the screen, with restriction per profile. While restricted, it ships with noindex, nofollow.