The only case when sesskey is not available is when we came to
subscribe.php from a link in email. In that case, we display a
confirmation page that redirects back providing the sesskey.
All other links to subscribe.php are fixed now so they provide sesskey
as a parameter.
I also polished $mode parameter handling a bit because the check
against empty string was not correct as the value is cast to PARAM_INT.
6f7d65c724