Require CORS check on all admin pages

This is mainly added so that an ad can't enable/disable the Pi-hole
by simply loading a url like `http://pi.hole/admin/index.php?disable`

php/sub.php

@@ -1,6 +1,14 @@
 <?php
 require('auth.php');
 
+if(!isset($_POST['domain'], $_POST['list'], $_POST['token'])) {
+    log_and_die("Missing POST variables");
+}
+
+check_cors();
+check_csrf();
+check_domain();
+
 switch($_POST['list']) {
     case "white":
         exec("sudo pihole -w -q -d ${_POST['domain']}");