Make antispam-protected links also be javascript-triggered

Make antispam-protected links also be javascript-triggered

This makes a tiny javascript run to convert it into a POST and then
receive that POST. The idea behind this is to remove the links from view
of crawlers (hello AI bots!) that completely ignore robots.txt, causing
lots of redirect chains on account of logins.

We still allow GET requests on those endpoints, as there are external
links pointing to them as well as people having scripts. But those are
at least to fewer emails than all.