Ensure auto-auth feature flag actually disables CSRF

Remove CSRF middleware/processor in aws and dev settings, instead of common settings.  This ensures that we load the `MITX_FEATURES` token BEFORE deciding to disable CSRF.

This is impossible to unit test, since doing so would require uninstalling Django middleware.  I verified the change manually by (a) overriding the `AUTOMATIC_AUTH_FOR_LOAD_TESTING` feature flag in lms/envs/dev.py and (b) creating env.json tokens that set the feature flag, then loading the tokens using lms/envs/aws.py.  I tested the HTTP status codes by sending POST requests to `/login` (usually CSRF protected).

Existing unit tests guarantee that CSRF is still enabled with default settings.

This PR includes the changes in Ed's PR (#544), so it won't conflict.

Reviewers: @jzoldak @e0d 

As soon as this gets merged, I can gp-deploy to the load test env and start executing the load tests.