Add authenticity token to return parameters

Devise is not storing the authenticated user in the session anymore if CSRF token validation fails.
https://github.com/plataformatec/devise/blob/master/lib/devise/strategies/base.rb#L5

I had to face this issue after recognizing, that (even after a successful authentication through the OpenID provider) the user was not kept logged in. I fixed the problem by sending the authenticity token with the return parameters.

CSRF token validation is turned off in tests. It would be an option to turn it on. But this would break two other tests.