Don't send CSRF token in HTML but retrieve it using JavaScript

[Derkades]

Introduce a new event to signal when web requests can be made.

Only applies to music player, not any of the static pages.

This fixes an issue with firefox restoring old HTML