SECURITY: CSRF protection in Private Messaging, which is a really broken feature and should get the TinyMCE treatment. *sigh* Reported by Secunia.

-- Postgres never did have a constraint on this column.
UPDATE {{TABLE_PREFIX}}pages SET page_format = 'tinymce' WHERE page_format = 'xhtml';