more helpful CSRF failure view, add CSRF settings to settings.py

without this, users get a rather unhelpful/misleading response after clicking "Login" if they don't have cookies enabled.