CSRF vulnerability with the change moderation state callback link

The menu callback "node/%node/moderation/%/change-state/%" is unprotected from a CSRF vulnerability where admins could be easily tricked into changing states on nodes. We need to use drupal_get_token() and drupal_valid_token() when creating links and in the callback itself.

This has not been reported to the security team as we do not yet have a final 1.0 release so this is cleared to be fixed publicly.