You asked 2. When do you get that exactly? - 'cross site forgery blocked' message
It seems I get it if I am running two separate instances of two different zenphoto installations in my browser at the same time - as I do sometimes, for instance, to make sure that various options are the same for both.
Thanks,
Richard