Ensure that the form authenticity token is present

Assume two users visit an action that is setup for caching.
If the page is not cached when the first user hits it,
the page will be generated for them and token_tag creates
a session['_csrf_token'] entry for the user.

Because the session var exists, the substitution can be done
for the first user.

When the second user hits the action, it's already cached,
so token_tag won't generate a csrf_token for them.

Calling form_authenticity_token instead of manually accessing
the session object ensures that the token is created for the user,
regardless of whether token_tag/csrf_meta_tags was called