Fixed CSRF issues in toolbar

CMSToolbar.csrf_token is now a property so it's not set too early
(before a token is available).
cms_toolbar tag now populates the toolbar, thus errors are actually
shown with TEMPLATE_DEBUG = True.
Minor improvements in selenium tests