fix: require POST for user block/unblock and OTP email, flag console cookie

- user_block, user_unblock and admin_email_otp changed state on GET, so an
  <img> tag could lock a user out or trigger OTP emails through an
  admin's session. They now require POST; the buttons are CSRF forms.
- The console token cookie is set with httponly, SameSite=Lax and, on
  HTTPS, secure. Only novncd reads it; the page gets the token directly.

console/views.py

@@ -166,5 +166,8 @@ def console(request):
             }
         response = render(request, "console-vnc-lite.html", locals())
 
-    response.set_cookie("token", token)
+    # Only novncd reads this cookie; JavaScript gets the token from the page.
+    response.set_cookie(
+        "token", token, httponly=True, samesite="Lax", secure=request.is_secure()
+    )
     return response