The CacheClear controller should verify the XSRF token

[TimWolla]

… and ideally the XSRF token should not be passed in the URL, requiring the Cache Clear button on CacheListPage to reside in a <form>.