include more specific information in tokens, validate blocks on save

I noticed two related problems:

1. The token for adding a block is just based on "homebox-$page->name" which means it is the same for adding any block. Ideally tokens are based on something unique to the site (private key) something unique to the user (session id) and something unique to the action being taken (e.g. a form ID if the form is only shown once on a page). drupal_get_token takes care of the first two parts, so it's up to homebox to use something like "homebox-$page->name-$block_module-$delta" as the token when building up the links for adding a block.

2. Once you have a token it's possible to request other blocks. So, I have a homebox at "funtimes" and I look at the source and find my token, I can make a request like:

http://d6.local/homebox/js/funtimes/add/user/3?token=95203e742a24ecec09e...

And now I add the "who's online" block to my dashboard settings. Note that it doesn't actually show me that block because homebox_build helpfully confirms the list of available blocks and sanity checks my list against that list before displaying them.

So, adding more unique information to the token would prevent me from doing item 2 (it would also complicate the access callback slightly). Problem 2 could also be solved by moving the " $allowed_blocks" check out of homebox_build to a helper function and using that helper function in _homebox_save_user_settings