Use an unique instance of the test session controller for every window
where a user has started a test. Theoretically, the user can now work on
the test from several different windows (with some restrictions).

Remove unused close blue box, hardened login, and class for the
authoring environment

Implement a CSRF token to protect a little more against CSRF attack.
Enhance the UI framework to allow opening a link in a new browser
window.