fix critical CSRF vulnerabilities on API routes

pkg/auth/auth.go

@@ -64,7 +64,7 @@ func SignedInID(c *macaron.Context, sess session.Store) (_ int64, isTokenAuth bo
 
 	uid := sess.Get("uid")
 	if uid == nil {
-		return 0
+		return 0, false
 	}
 	if id, ok := uid.(int64); ok {
 		if _, err := models.GetUserByID(id); err != nil {
@@ -119,7 +119,7 @@ func SignedInUser(ctx *macaron.Context, sess session.Store) (_ *models.User, isB
 						}
 					}
 				}
-				return u, false
+				return u, false, false
 			}
 		}