- Validate user email before sending welcome message

- Remove old code from edit_user - we now enforce admin role properly
- Users may only edit their own profiles - enforced via session id rather than role
- Rem ticket views deletion comment - ticket views are cleaned up daily via cron
- Require CSRF Token when adding/removing 2FA and backing up master key

settings_backup.php

@@ -18,6 +18,7 @@
     <div class="card-body">
         <center>
             <form action="post.php" method="POST">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                 <div class="input-group col-4">
                     <div class="input-group-prepend">
                         <input type="password" class="form-control" placeholder="Enter your account password" name="password" autocomplete="new-password" required>