Edit policy for the owned notes app.

An edit is applied only when both requirements hold:
  the login cookie for the caller
  a supplied CSRF token matching the value expected for that caller's session

The cookie may be attached by the browser when the browser sends the request.
The token is a second value the intended page has to send.
A request caused by another site can carry the cookie and still lack the token.